updated to add ssl (not tested)

roles/nginx-proxy/templates/default.conf.j2

@@ -1,29 +1,50 @@
-# Landing page (root path)
+# Redirect HTTP → HTTPS (except ACME challenges)
 server {
     listen 80;
-    server_name {{ landing_domain }} {{ matrix_domain }};
+    server_name {{ matrix_domain }} {{ landing_domain }};
 
-    root {{ nginx_webroot }};
-    index index.html;
-
-    location / {
-        try_files $uri $uri/ =404;
+    # ACME-challenge (for Let's Encrypt)
+    location ~ /.well-known/acme-challenge/ {
+        root /var/www;
+        try_files $uri =404;
     }
 
-    # Matrix Synapse
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS server
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # TLS certs (mounted from Let's Encrypt dir)
+    ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
+
+    ssl_session_cache shared:SSL:10m;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    # Serve static site (root)
+    location / {
+        root /usr/share/nginx/html/mysite;
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Matrix Synapse (client)
     location /_matrix/ {
         proxy_pass http://127.0.0.1:8008/_matrix/;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Server $host;
         proxy_buffering off;
-        proxy_request_buffering off;
     }
 
-    # Federation (port 8448 usually, but often proxied at /_matrix too)
+    # Federation
     location /_matrix/federation/v1/ {
         proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/;
         proxy_set_header Host $host;
@@ -32,5 +53,8 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # Optional: Caddy or Let’s Encrypt ACME
-}
+    # Optional: Add a Matrix admin link
+    location /admin {
+        return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
+    }
+}