server {
server_name blah.ru;
root /var/www/html/blah.ru;
index index.php;

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/blah.ru/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/blah.ru/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
server_name www.blah.ru;
return 301 $scheme://blah.ru$request_uri;

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/blah.ru/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/blah.ru/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}server {
if ($host = blah.ru) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name blah.ru;
return 404; # managed by Certbot

}

server {
if ($host = www.blah.ru) {
return 301 https://$host$request_uri;
} # managed by Certbot

server_name www.blah.ru;
listen 80;
return 404; # managed by Certbot

}