infrastructure/roles/mta_sts/templates/nginx.d.conf.j2

{% for config in mta_sts %}
{% set domain = "mta-sts." + config.domains | first %}
server {
    listen       80;
    listen       [::]:80;
    server_name  mta-sts.{{ config.domains | join(' mta-sts.') }};

    access_log   /var/log/nginx/{{ domain }}/access.log reduced;
    error_log    /var/log/nginx/{{ domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  mta-sts.{{ config.domains | join(' mta-sts.') }};

    access_log   /var/log/nginx/{{ domain }}/access.log reduced;
    error_log    /var/log/nginx/{{ domain }}/error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ domain }}/chain.pem;

    location /.well-known/mta-sts.txt {
        default_type text/plain;
        return 200 'version: STSv1\nmode: testing\nmax_age: 604800\nmx: {{ config.mx | join('\\nmx: ')}}\n';
    }

    location / {
        access_log off;
        return 404;
    }
}
{% endfor %}