server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name {{SERVER_NAMES}};
    server_tokens off;
    client_max_body_size 64m;
    ssl_certificate {{CERT_DIR}}/fullchain.pem;
    ssl_certificate_key {{CERT_DIR}}/privkey.pem;
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
{{BODY}}
}