# im Repo-Wurzelverzeichnis:
sudo tee config/nginx/site.conf.tmpl >/dev/null <<'EOF'
# ===================== HTTP (Port 80) =====================
server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name _;

  # ACME HTTP-01
  location ^~ /.well-known/acme-challenge/ {
    root /var/www/letsencrypt;
    allow all;
  }

  ## __HTTP_BODY__
}

# ===================== HTTPS (Port 443) ====================
## __SSL_SERVER_BLOCK__
EOF

# sicherheitshalber Default-Site entfernen (sonst doppelter default_server)
sudo rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-available/default

# Nginx-Step erneut laufen lassen
cd scripts
sudo -E bash 70-nginx.sh

# Prüfen
sudo nginx -t && sudo systemctl reload nginx