nginx: add catch-all default_server returning 404 for unmatched hostsHEADmain

Without an explicit default_server, nginx falls back to the first
alphabetically-loaded vhost for any request whose Host or SNI matches no
server_name. Add an explicit catch-all that returns a plain 404 over
HTTP and rejects the TLS handshake (ssl_reject_handshake, nginx >=
1.19.4) so unmatched HTTPS requests are not served a mismatched cert.

0 files changed, 0 insertions, 0 deletions