Nginx redirect to www

Question

I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added but am not sure, because like I said the other blocks have the same config and this is the config file:

server {

        root /var/www/mydomain;
        index index.php index.html index.htm index.nginx-debian.html;

        server_name mydomain.es www.mydomain.es;


        location / {
                #try_files $uri $uri/ =404;
                try_files $uri $uri/ /index.php$is_args$args;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        }

        location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
                expires max;
                log_not_found off;
        }

                location = /favicon.ico { log_not_found off; access_log off; }
                location = /robots.txt { log_not_found off; access_log off; allow all; }
                location ~* \.(css|gif|ico|jpeg|jpg|js|png|svg|woff)$ {
                expires 2d;
                add_header Cache-Control "public, no-transform";
        }

                location ~* \.(jpg|jpeg|gif|png|svg|woff)$ {
                        expires 365d;
        }

                location ~* \.(pdf|css|html|js|swf)$ {
                        expires 2d;
        }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mydomain.es/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain.es/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

}

server {
    if ($host = www.mydomain.es) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = mydomain.es) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name mydomain.es www.mydomain.es;
    listen 80;
    return 404; # managed by Certbot
}

What am I doing wrong?

Answer 1

Both of your blocks listen on the same ports for the same domains - note your listen and server_name statements. You're also using if statements which aren't optimal. It's also odd to accept visitors on either www or non-www, most sites choose one or the other and redirect to that.

Here's the standard pattern for redirecting to the www site, including the security headers I use

# Main server block serving content
server {
  server_name example.com;

  listen 443 ssl http2;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  # Generate at https://cipherli.st/
  # NB: I had to comment out session tockets, stapling, and resolver to get this to work, but I didn't try very hard.
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
  ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off; # Requires nginx >= 1.5.9
  ssl_stapling on; # Requires nginx >= 1.3.7
  ssl_stapling_verify on; # Requires nginx => 1.3.7
  resolver ****** $DNS-IP-1 $DNS-IP-2 valid=300s;
  resolver_timeout 5s;
  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;

  etc
}

# This server simply redirects the requested to the https version of the page
server {
  listen 80;
  server_name www.example.com example.com;

  location /.well-known/acme-challenge/ {
    alias /var/www/.well-known/acme-challenge/;
  }

  location / {
    return 301 https://www.example.com$request_uri;
  }
}

server {
  listen 443 ssl http2;
  server_name www.example.com;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
  ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0

  access_log  /var/log/nginx/access.log main buffer=32k flush=1m if=$log_ua;

  return 301 https://www.example.com$request_uri;
}