Sync nginx confs to match live production + add shared-asset aliases

The committed .conf files were stale pre-certbot templates that no
longer matched what's actually running on gg1-roc-web1 (certbot --nginx
had rewritten 40k-rankings/aos-rankings/kingmaker's structure, and in
the process 40k-rankings and aos-rankings lost their security headers
entirely). Replaced each with the true live config, plus the new
location /images/ and location = /footer.html alias blocks that were
applied directly on the server.

Also fixed on gg1-roc-web1 while there (not reflected in this repo,
just noting for the record):
- kingmaker's TLS cert had expired 2026-08-26; renewed.
- certbot-renew.timer was enabled but never started (box hasn't
  rebooted in 172 days), so nothing was auto-renewing; started it and
  ran a full certbot renew, which also caught 40k-rankings/aos-rankings
  sitting inside their renewal window.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SBzcNkW7JcYipnAX6HfgmK

sites/40k-rankings/40k-rankings.gateway-gamers.net.conf

@@ -1,37 +1,11 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name 40k-rankings.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name 40k-rankings.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/40k-rankings;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
     server_tokens off;
 
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +17,25 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/40k-rankings.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
 }
+server {
+    if ($host = 40k-rankings.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name 40k-rankings.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
+}

sites/aos-rankings/aos-rankings.gateway-gamers.net.conf

@@ -1,37 +1,11 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name aos-rankings.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name aos-rankings.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/aos-rankings;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
     server_tokens off;
 
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +17,25 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/aos-rankings.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
 }
+server {
+    if ($host = aos-rankings.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name aos-rankings.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
+}

sites/kingmaker/kingmaker.gateway-gamers.net.conf

@@ -1,37 +1,9 @@
 server {
-    listen 80;
-    listen [::]:80;
-    server_name kingmaker.gateway-gamers.net;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     server_name kingmaker.gateway-gamers.net;
 
     root /var/www/domains/gateway-gamers.net/kingmaker;
     index index.html;
 
-    # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/kingmaker.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/kingmaker.gateway-gamers.net/privkey.pem;
-    # include /etc/letsencrypt/options-ssl-nginx.conf;
-    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # Hide nginx version
-    server_tokens off;
-
-    # Security headers
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; frame-src https://docs.google.com; img-src 'self' data:;" always;
-
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -43,4 +15,36 @@ server {
     location / {
         try_files $uri $uri/ =404;
     }
+
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/kingmaker.gateway-gamers.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/kingmaker.gateway-gamers.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+    
+
+    # Hide nginx version
+    server_tokens off;
+      
+    # Security headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; frame-src https://docs.google.com; img-src 'self' data:;" always;
+}
+server {
+    if ($host = kingmaker.gateway-gamers.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name kingmaker.gateway-gamers.net;
+    return 404; # managed by Certbot
+
+
 }

sites/scouting/scouting.gateway-gamers.net.conf

@@ -14,8 +14,8 @@ server {
     index index.html;
 
     # SSL — managed by Certbot
-    # ssl_certificate /etc/letsencrypt/live/scouting.gateway-gamers.net/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/scouting.gateway-gamers.net/fullchain.pem;
-    # ssl_certificate_key /etc/letsencrypt/live/scouting.gateway-gamers.net/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/scouting.gateway-gamers.net/privkey.pem;
     # include /etc/letsencrypt/options-ssl-nginx.conf;
     # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
@@ -35,8 +35,6 @@ server {
     # style attribute).
     add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always;
 
-    # Shared assets (images + footer) — single on-disk copy under shared/,
-    # deployed once and aliased by every gateway-gamers.net site.
     location /images/ {
         alias /var/www/domains/gateway-gamers.net/shared/images/;
     }
@@ -49,3 +47,4 @@ server {
         try_files $uri $uri/ =404;
     }
 }
+