301 redirect.

config/nginx/rstat.net-SSL.conf

@@ -2,7 +2,25 @@ server {
   listen 443 ssl;
   listen [::]:443 ssl;
 
-  server_name www.rstat.net rstat.net;
+  server_name www.rstat.net;
+  server_tokens off;
+
+  http2 on;
+
+  ssl_certificate /etc/nginx/ssl/live/www.rstat.net/fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/live/www.rstat.net/privkey.pem;
+
+  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+  add_header Strict-Transport-Security "max-age=63072000" always;
+
+  return 301 https://rstat.net$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  server_name rstat.net;
   server_tokens off;
 
   http2 on;