nginx_host.conf

$def with (domain, nginx_dir, host_body, tls_on)
server {
    listen       80;
    server_name  $domain;

    location /.well-known/acme-challenge/ {
        alias      $nginx_dir/domains/letsencrypt-challenges/;
        try_files  $$uri  =404;
    }
$if tls_on:
        location / {
            return  301  https://$domain$$request_uri;
        }
$else:
    $:host_body
}

$if tls_on:
    server {
        listen       443 http2 ssl;
        server_name  $domain;

        ssl_certificate            $nginx_dir/domains/$domain/chain.crt;
        ssl_certificate_key        $nginx_dir/domains/$domain/domain.key;
        ssl_session_cache          shared:SSL:10m;
        ssl_session_timeout        30m;
        ssl_protocols              TLSv1.2;
        ssl_dhparam                /home/gaea/detritus/nginx/conf/dhparam.pem;
        ssl_prefer_server_ciphers  on;
        ssl_ciphers                ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

        $:host_body
    }