server_name {{ MEDIA_FQDN | last }}; 
    listen 443 ssl; 
    if ($scheme = http) { 
        return 301 https://$server_name$request_uri; 
    }
 
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_prefer_server_ciphers on; 
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 
    ssl_ecdh_curve secp384r1; 
    ssl_session_cache shared:SSL:10m; 
    ssl_session_tickets off; 
    ssl_stapling on; 
    ssl_stapling_verify on; 
    #resolver 8.8.8.8 8.8.4.4 valid=300s; 
    #resolver_timeout 5s; 
    add_header Strict-Transport-Security "max-age=63072000"; # The `includeSubDomains` isn't specified to not force subdomains (which might be out of our control) use SSL
    add_header X-Frame-Options DENY; 
    add_header X-Content-Type-Options nosniff; 
    ssl_dhparam /etc/ssl/dhparam.pem; 
    ssl_certificate /etc/ssl/private/ssl-certificate.pem; 
    ssl_certificate_key /etc/ssl/private/ssl-certificate-key.pem;
