{% if lookup('tls', application_id, 'enabled') | bool %}
listen {{ lookup('tls', application_id, 'ports.web') }} ssl;
listen [::]:{{ lookup('tls', application_id, 'ports.web') }} ssl;
http2 on;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:P-256;
ssl_prefer_server_ciphers on;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets on;

add_header Strict-Transport-Security "{{ (lookup('applications') | security_headers(application_id, WEBSERVER_SECURITY_HEADERS)).hsts }}" always;

ssl_stapling on;
ssl_stapling_verify on;

{% include 'roles/sys-front-tls/templates/ssl_credentials.j2' %}

{% else %}
listen {{ lookup('tls', application_id, 'ports.web') }};
listen [::]:{{ lookup('tls', application_id, 'ports.web') }};
{% endif %}