add_header Strict-Transport-Security "max-age=31536000" always;
# . files
location ~ /\.(?!well-known) {
    deny all;
}