domain="$__object_id"
webroot="$(cat "$__object/parameter/webroot")"
# make sure we have nginx package
__package nginx
# setup Let's Encrypt HTTP acme challenge, redirect HTTP to HTTPS
require="__package/nginx" __file "/etc/nginx/sites-enabled/http-$domain" \
    --source - --mode 0644 << EOF
server {
    listen *:80;
    listen [::]:80;

    server_name $domain;

    # Let's Encrypt
    location /.well-known/acme-challenge/ {
        root $webroot;
    }

    # Everything else -> SSL
    location / {
        return 301 https://\$host\$request_uri;
    }
}

EOF