server {
    listen 8004 ssl http2;
    listen [::]:8004 ssl http2;

    root /srv/cts/cts;

    access_log /var/log/nginx/cts.access.log;
    error_log /var/log/nginx/cts.error.log;

    location /robots.txt {
        alias /srv/cts/cts/static/robots.txt;
    }

    location /media {
        alias /srv/cts/cts/media;
    }

    location /static {
        gzip on;
        alias /srv/cts/cts/static;
        expires max;
        add_header Cache-Control public;

        location /static/protected {
            return 401;
        }
    }

    location /protected {
        internal;
        root /srv/cts/cts/static;
    }

    error_page 502 503 504 /502.html;

    location /502.html {
        alias /srv/cts/cts/static/502.html;
    }

    location / {
        uwsgi_pass unix:///run/uwsgi/app/cts/socket;
        include uwsgi_params;
    }
}