listen 443 ssl;
listen 4443 ssl;
# The "http2" listen parameter is deprecated since nginx 1.25.1 in favor of
# this standalone directive, which applies to every "listen ... ssl" in the
# server block (both 443 and 4443 here).
http2 on;

ssl_protocols     TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers  on;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!3DES:!MD5;

ssl_certificate_by_lua_block {
    auto_ssl:ssl_certificate()
}

location /.well-known/acme-challenge/ {
    content_by_lua_block {
        auto_ssl:challenge_server()
    }
}

ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;