server {
    listen 80;
    server_name ${PUBLIC_HOST};

    location = /nginx-health/live {
        access_log off;
        return 200 "ok\n";
    }
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        default_type text/plain;
    }
    location ^~ /internal/ { return 404; }
    location ^~ /_internal/ { return 404; }
    location / { return 308 https://$host$request_uri; }
}