# don't respond to direct IP address requests
server {
  listen 80 default_server;
  listen [::]:80 default_server;

  listen 443 default_server;
  listen [::]:443 default_server;

  ssl_reject_handshake on;

  server_name _;
  return 444;
}