# Catch-all for Host headers no vhost claims (scanners, direct IP access,
# stale DNS). Without it nginx hands them to the first vhost it loaded,
# i.e. Gitea. ACME stays reachable here so a certificate for a new hostname
# can be issued before its vhost exists.
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 444;
    }
}

# No certificate to present for an unknown name, so refuse the handshake.
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name _;
    ssl_reject_handshake on;
}