- Disable access logs. AFAICT these must be files, rather than
  references to stdout/stderr (I couldn't get that working). Since we'll
  be running in Kubernetes, we'd have to add a mechanism to pipe that
  file to stdout so that it shows up in logs, which doesn't seem worth
  it. Or bind-mount the file to a shared volume and use fluentd or
  similar to pipe it out, which also doesn't seem worth it.
- Change error log to stderr. Kubernetes containers won't have
  permission to open /dev/console, and neither did my local docker
  setup. Using stderr means that these logs will be visible in
  kubectl-logs too.
- Fix typo in "maintenance" for redirect
- Use 302 instead of 301. The browser 301 cache needs to be specifically
  cleared, which makes iteration tricky. We are not bottlenecked on the
  latency of the user's 301 cache anyway :)
- Add $server_port to redirect. Indeed, if we bind port 80 this is a
  no-op, but it might avoid confusing bugs in the future.
- I think we had a redirect loop, which I've tried to fix with some ugly
  nginx logic (turns out it doesn't have and/or, and nested ifs cause
  warnings in linters I found). I managed to stop the loop, and I think
  the redirect logic works now...