local rootDir, user, group = ...

%>
	proxy_cache_path /usr/local/nginx_cache levels=1:2 keys_zone=nginx_cache:60m max_size=10g inactive=60m use_temp_path=off;
	server {
		# ensure no other default_server exists!
		# nginx usually has one at /etc/nginx/sites-enabled/default
		listen 80 default_server;
		listen [::]:80 default_server;
		include <%=rootDir%>/local/nginx.default.conf;

		location /.well-known/acme-challenge/ {
			# $host/ssl does not exist for non-ssl sites and requests to here
			# will fail with 404 for those sites, which is what we want
			alias <%=rootDir%>/sites/$host/ssl/acme-challenge/;
			try_files $uri $uri/ =404;
		}
	}

	# glob pattern returns no results for site dirs that don't have 
	# the ssl/ subdir, so this is ok
	include <%=rootDir%>/sites/*/ssl/nginx.ssl.conf;
<%