feat: centralize nginx TLS and proxy defaults

conf.d/00-request-maps.conf.template

@@ -1,5 +1,6 @@
 map_hash_bucket_size 128;
 
+# Normalize the Connection header for WebSocket upgrades.
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;

conf.d/10-defaults.conf.template

@@ -1,3 +1,8 @@
+http2 on;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
@@ -9,9 +14,6 @@ server {
 server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
-    include snippets/https.conf;
 
-    server_name _;
-
-    return 404;
+    ssl_reject_handshake on;
 }

conf.d/adguardhome.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name adguard.${BASE_DOMAIN};
 

conf.d/backrest.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name backrest.${BASE_DOMAIN};
 

conf.d/gitea.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name gitea.${BASE_DOMAIN};
 

conf.d/homeassistant.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name ha.${BASE_DOMAIN};
 

conf.d/immich.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name immich.${BASE_DOMAIN};
 

conf.d/openlist.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name openlist.${BASE_DOMAIN};
 

conf.d/qbittorrent.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name qbt.${BASE_DOMAIN};