# Catch-all for any domain not handled by mail.conf
# Proxies ACME challenges to K8s for cert-manager, redirects rest to HTTPS
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    location /.well-known/acme-challenge/ {
        include /etc/nginx/k8s-backend-ip.conf;
        proxy_pass http://$k8s_ip:80;
        proxy_set_header Host $host;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}