ansible_role_nginx/templates/nginx/sites-available/default_tls.j2

server {
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;

        include snippets/tls_parameters.snippet.conf;

        ssl_certificate /var/lib/acme/live/{{ inventory_hostname }}/fullchain;
        ssl_certificate_key /var/lib/acme/live/{{ inventory_hostname }}/privkey;

        access_log /var/log/nginx/log_{{ inventory_hostname }}.access.log;
        error_log /var/log/nginx/log_{{ inventory_hostname }}.error.log;

        location ^~ / {
                return 403;
        }
}