map $http_x_forwarded_proto $effective_forwarded_proto {
    default $scheme;
    https https;
}

server_tokens off;
limit_req_status 429;
limit_req_zone $binary_remote_addr zone=site:10m rate=30r/s;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

resolver 127.0.0.11 valid=10s ipv6=off;

upstream wordpress_backend {
    zone wordpress_backend 64k;
    server wordpress:80 resolve;
    keepalive 16;
}

server {
    listen 80 default_server;
    server_name _;

    location = /nginx-health {
        access_log off;
        return 200 "ok\n";
    }

    location = /wordpress-health {
        access_log off;
        allow 127.0.0.1;
        deny all;
        proxy_intercept_errors on;
        error_page 301 302 303 307 308 = @wordpress-health-ok;
        proxy_set_header Host __DOMAIN__;
        proxy_pass http://wordpress_backend/wp-login.php;
    }

    location @wordpress-health-ok {
        access_log off;
        return 204;
    }

    location / {
        return 404;
    }
}

server {
    listen 80;
    server_name __DOMAIN__;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        default_type text/plain;
        try_files $uri =404;
    }

    include /etc/nginx/http-enabled/site.conf;
}

include /etc/nginx/tls-enabled/*.conf;