# не даём доступ по IP, только по доменному имени
server {
    listen 1.2.3.4:80 default_server;
    server_name "";
    return 444;
}

server {
    listen 1.2.3.4:443 ssl default_server;
    server_name "";

    ssl_certificate /etc/ssl/certs/mycoolsite.com.crt;
    ssl_certificate_key /etc/ssl/private/mycoolsite.com.key;

    return 444;
}

# с http перенаправляем на https
server {
    listen 1.2.3.4:80;
    server_name mycoolsite.com www.mycoolsite.com;
    return 301 https://$host$request_uri;
}

# основная конфигурация для доступа по доменному имени
server {
    listen 1.2.3.4:443 ssl http2;
    server_name mycoolsite.com www.mycoolsite.com;

    ssl_certificate /etc/ssl/certs/mycoolsite.com.crt;
    ssl_certificate_key /etc/ssl/private/mycoolsite.com.key;

    autoindex off;

    root /var/www/mycoolsite;

    index index.html;

    #здесь описывается локация сервиса с вэб-сокетом
    location /ws/ {
        proxy_cache off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
        proxy_set_header Origin "";
        proxy_pass http://127.0.0.1:8011; # yggdrasil будет слушать на 127.0.0.1:8011
    }
}

# доступ к сайту по IP-адресу yggdrasil
server {
    listen [201:201a:201b:201c:201d:201e:201f:2010]:80 default_server;

    autoindex off;

    root /var/www/mycoolsite;

    index index.html;

    gzip on;
    gzip_types text/plain text/xml text/css text/javascript application/xml application/javascript application/x-javascript application/json;
    gzip_min_length 256;
    gzip_comp_level 9;
    gzip_static on;
}