rework nginx structure

author: Christian Cleberg <[email protected]> 2026-04-15 18:52:24 -0500
committer: Christian Cleberg <[email protected]> 2026-04-15 18:52:24 -0500
commit: e4433473801de1249845fe183d93095652c159ea (patch)
tree: dafdb86b475534c4ee001fef84264adf49c957f3
parent: 5a143ea3c0e6436e010299b2007c16b6aa6be569 (diff)
download: dotfiles-e4433473801de1249845fe183d93095652c159ea.tar.gz
dotfiles-e4433473801de1249845fe183d93095652c159ea.tar.bz2
dotfiles-e4433473801de1249845fe183d93095652c159ea.zip
53 files changed, 392 insertions, 354 deletions
diff --git a/linux/nginx/etc/nginx/conf.d/1kb.conf b/linux/nginx/etc/nginx/conf.d/1kb.conf
index 4dea167..4632b68 100644
--- a/linux/nginx/etc/nginx/conf.d/1kb.conf
+++ b/linux/nginx/etc/nginx/conf.d/1kb.conf
@@ -1,5 +1,5 @@
 server {
-    listen 443;
+    listen 443 ssl;
     http2 on;
     server_name 1kb.zerolabs.sh;
 
@@ -19,7 +19,7 @@ server {
     charset off;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_zerolabs_sh.conf;
 
     location = / {
         try_files /index.html =404;
diff --git a/linux/nginx/etc/nginx/conf.d/ao.conf b/linux/nginx/etc/nginx/conf.d/ao.conf
index 3d955f5..d764c6b 100644
--- a/linux/nginx/etc/nginx/conf.d/ao.conf
+++ b/linux/nginx/etc/nginx/conf.d/ao.conf
@@ -9,12 +9,11 @@ server {
 
 	add_header Onion-Location "http://7lyqrn4ofxdq7lfporviu44zpc42wooh2bqazfhvpscgwby2vcwldzad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:9380;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
diff --git a/linux/nginx/etc/nginx/conf.d/art.conf b/linux/nginx/etc/nginx/conf.d/art.conf
index c12b32c..f2b3936 100644
--- a/linux/nginx/etc/nginx/conf.d/art.conf
+++ b/linux/nginx/etc/nginx/conf.d/art.conf
@@ -9,12 +9,11 @@ server {
 	}
 
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:3003;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
diff --git a/linux/nginx/etc/nginx/conf.d/auth.conf b/linux/nginx/etc/nginx/conf.d/auth.conf
index f8e58ca..5987bd7 100644
--- a/linux/nginx/etc/nginx/conf.d/auth.conf
+++ b/linux/nginx/etc/nginx/conf.d/auth.conf
@@ -3,15 +3,14 @@ server {
 	http2 on;
 	server_name auth.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
-    set $upstream http://127.0.0.1:9092;
 	location / {
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
-	location /api/verify { proxy_pass $upstream; }
+	location /api/verify { proxy_pass $backend_address; }
 }
 
 server {
diff --git a/linux/nginx/etc/nginx/conf.d/br.conf b/linux/nginx/etc/nginx/conf.d/br.conf
index f430c64..a917ec1 100644
--- a/linux/nginx/etc/nginx/conf.d/br.conf
+++ b/linux/nginx/etc/nginx/conf.d/br.conf
@@ -4,12 +4,11 @@ server {
 	server_name br.zerolabs.sh  pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion;
 	add_header Onion-Location "http://pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
     location / {
-		set $upstream http://127.0.0.1:3030;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
     }
     include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name br.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://br.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/bt.conf b/linux/nginx/etc/nginx/conf.d/bt.conf
index c3b4415..1d5ed84 100644
--- a/linux/nginx/etc/nginx/conf.d/bt.conf
+++ b/linux/nginx/etc/nginx/conf.d/bt.conf
@@ -4,7 +4,7 @@ server {
 	server_name bt.zerolabs.sh;
 
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 
@@ -30,7 +30,7 @@ server {
 		proxy_set_header X-Forwarded-Server $host;
 
 		proxy_pass_header X-Transmission-Session-Id;
-		proxy_pass http://127.0.0.1:9091;
+		proxy_pass $backend_address;
 	}
 }
 
@@ -52,7 +52,7 @@ server {
     server_name bt.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://bt.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/bw.conf b/linux/nginx/etc/nginx/conf.d/bw.conf
index 2069cb9..b78fee8 100644
--- a/linux/nginx/etc/nginx/conf.d/bw.conf
+++ b/linux/nginx/etc/nginx/conf.d/bw.conf
@@ -4,12 +4,11 @@ server {
     server_name bw.zerolabs.sh  z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion;
 	add_header Onion-Location "http://z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion$request_uri" always;
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / {
-             set $upstream http://127.0.0.1:10416;
-             proxy_pass $upstream;
+             proxy_pass $backend_address;
              include custom.d/reverse_proxy/basic.conf;
     }
     include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name bw.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://bw.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/cc.conf b/linux/nginx/etc/nginx/conf.d/cc.conf
index c35155b..3db5cff 100644
--- a/linux/nginx/etc/nginx/conf.d/cc.conf
+++ b/linux/nginx/etc/nginx/conf.d/cc.conf
@@ -4,12 +4,11 @@ server {
 	server_name cc.zerolabs.sh  gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion;
 	add_header Onion-Location "http://gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:8111;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name cc.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://cc.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
index 9c8c1fc..1030307 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
@@ -4,9 +4,7 @@ server {
         server_name www.cleberg.dev;
         include custom.d/tls/ssl_engine.conf;
         include custom.d/tls/policy_strict.conf;
-        ssl_certificate         /etc/letsencrypt/live/cleberg.dev/fullchain.pem;
-        ssl_certificate_key     /etc/letsencrypt/live/cleberg.dev/privkey.pem;
-        ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem;
+        include custom.d/tls/certificate_files_cleberg_dev.conf;
         return 301 $scheme://cleberg.dev$request_uri;
 }
 
@@ -18,10 +16,8 @@ server {
         root /var/www/cleberg.dev/;
         include custom.d/tls/ssl_engine.conf;
         include custom.d/tls/policy_strict.conf;
+        include custom.d/tls/certificate_files_cleberg_dev.conf;
         include custom.d/basic.conf;
-        ssl_certificate         /etc/letsencrypt/live/cleberg.dev/fullchain.pem;
-        ssl_certificate_key     /etc/letsencrypt/live/cleberg.dev/privkey.pem;
-        ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem;
         location / { try_files $uri $uri/ =404; }
 }
 
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
index ef65f8f..f3625f3 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
@@ -4,10 +4,8 @@ server {
 	server_name cleberg.io;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/policy_strict.conf;
+	include custom.d/tls/certificate_files_cleberg_io.conf;
 	include custom.d/basic.conf;
-	ssl_certificate         /etc/letsencrypt/live/cleberg.io/fullchain.pem;
-	ssl_certificate_key     /etc/letsencrypt/live/cleberg.io/privkey.pem;
-	ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem;
 	return 301 https://cleberg.net;
 }
 
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
index 13020ce..bbf2bd1 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
@@ -3,7 +3,7 @@ server {
 	http2 on;
 	server_name cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	include custom.d/security/strict-transport-security.conf;
@@ -13,33 +13,7 @@ server {
 
 	add_header Onion-Location "http://paske4urhs6nttrtlkuwa5cowum3fjkc6yv6kl4ncx3mjxcd77764nqd.onion$request_uri" always;
 
-	location /org/ {
-		internal;
-		alias /var/www/cleberg.net/org/;
-		default_type text/plain;
-		add_header Content-Type "text/plain; charset=utf-8";
-	}
-
-	location / {
-		try_files $uri $uri/ =404;
-	}
-
-	location /blog/ {
-		rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent;
-		if ($http_accept ~* "text/markdown") {
-			rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last;
-		}
-	}
-
-	location ~ ^/([^/]+)\.html$ {
-		if ($http_accept ~* "text/markdown") {
-			rewrite ^/([^/]+)\.html$ /org/$1.org last;
-		}
-		try_files $uri =404;
-	}
-
-	location /atom.xml { return 301 $scheme://$host/feed.xml; }
-	location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; }
+	include custom.d/sites/cleberg_net_static_locations.conf;
 }
 
 server {
@@ -47,7 +21,7 @@ server {
 	http2 on;
 	server_name hutch.cleberg.net;
         include custom.d/tls/ssl_engine.conf;
-        include custom.d/tls/certificate_files.conf;
+        include custom.d/tls/certificate_files_cleberg_net.conf;
         include custom.d/tls/policy_strict.conf;
         include custom.d/basic.conf;
         include custom.d/security/strict-transport-security.conf;
@@ -69,31 +43,5 @@ server {
     include custom.d/basic.conf;
     root /var/www/cleberg.net/;
 
-    location /org/ {
-        internal;
-        alias /var/www/cleberg.net/org/;
-        default_type text/plain;
-        add_header Content-Type "text/plain; charset=utf-8";
-    }
-
-    location / {
-        try_files $uri $uri/ =404;
-    }
-
-    location /blog/ {
-        rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent;
-        if ($http_accept ~* "text/markdown") {
-            rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last;
-        }
-    }
-
-    location ~ ^/([^/]+)\.html$ {
-        if ($http_accept ~* "text/markdown") {
-            rewrite ^/([^/]+)\.html$ /org/$1.org last;
-        }
-        try_files $uri =404;
-    }
-
-    location /atom.xml { return 301 $scheme://$host/feed.xml; }
-    location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; }
+    include custom.d/sites/cleberg_net_static_locations.conf;
 }
diff --git a/linux/nginx/etc/nginx/conf.d/cv.conf b/linux/nginx/etc/nginx/conf.d/cv.conf
index 3f8273e..a7230f8 100644
--- a/linux/nginx/etc/nginx/conf.d/cv.conf
+++ b/linux/nginx/etc/nginx/conf.d/cv.conf
@@ -4,7 +4,7 @@ server {
 	server_name cv.cleberg.net;
 	add_header Onion-Location "http://xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/cv/;
diff --git a/linux/nginx/etc/nginx/conf.d/ddns.conf b/linux/nginx/etc/nginx/conf.d/ddns.conf
index 22ced24..b1abc2f 100644
--- a/linux/nginx/etc/nginx/conf.d/ddns.conf
+++ b/linux/nginx/etc/nginx/conf.d/ddns.conf
@@ -3,13 +3,12 @@ server {
 	http2 on;
 	server_name ddns.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:8097;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
diff --git a/linux/nginx/etc/nginx/conf.d/files.conf b/linux/nginx/etc/nginx/conf.d/files.conf
index ffec3c6..3419310 100644
--- a/linux/nginx/etc/nginx/conf.d/files.conf
+++ b/linux/nginx/etc/nginx/conf.d/files.conf
@@ -4,7 +4,7 @@ server {
 	server_name files.cleberg.net;
 	add_header Onion-Location "http://yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/files/;
diff --git a/linux/nginx/etc/nginx/conf.d/gh.conf b/linux/nginx/etc/nginx/conf.d/gh.conf
index 16e9697..8f6ab22 100644
--- a/linux/nginx/etc/nginx/conf.d/gh.conf
+++ b/linux/nginx/etc/nginx/conf.d/gh.conf
@@ -3,12 +3,11 @@ server {
 	http2 on;
 	server_name gh.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://192.168.0.251:3039;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -32,7 +31,7 @@ server {
     server_name gh.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://gh.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/gramps.conf b/linux/nginx/etc/nginx/conf.d/gramps.conf
index a71467f..7c60488 100644
--- a/linux/nginx/etc/nginx/conf.d/gramps.conf
+++ b/linux/nginx/etc/nginx/conf.d/gramps.conf
@@ -3,13 +3,12 @@ server {
 	http2 on;
 	server_name gramps.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:5566;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
diff --git a/linux/nginx/etc/nginx/conf.d/ha.conf b/linux/nginx/etc/nginx/conf.d/ha.conf
index 8cb5e0a..5ee6694 100644
--- a/linux/nginx/etc/nginx/conf.d/ha.conf
+++ b/linux/nginx/etc/nginx/conf.d/ha.conf
@@ -3,16 +3,15 @@ server {
 	http2 on;
 	server_name ha.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
-	set $upstream http://192.168.0.214:8123;
 	location / {
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		proxy_set_header X-Forwarded-For $remote_addr;
 	}
 	location /api/websocket {
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		proxy_http_version 1.1;
 		proxy_set_header Upgrade $http_upgrade;
 		proxy_set_header Connection "upgrade";
diff --git a/linux/nginx/etc/nginx/conf.d/hat.conf b/linux/nginx/etc/nginx/conf.d/hat.conf
index 7d86d92..7a28e67 100644
--- a/linux/nginx/etc/nginx/conf.d/hat.conf
+++ b/linux/nginx/etc/nginx/conf.d/hat.conf
@@ -4,12 +4,11 @@ server {
 	server_name hat.zerolabs.sh  jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion;
 	add_header Onion-Location "http://jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://192.168.0.251:3991;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
     include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name hat.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://hat.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/hn.conf b/linux/nginx/etc/nginx/conf.d/hn.conf
index 41119b4..e57dff9 100644
--- a/linux/nginx/etc/nginx/conf.d/hn.conf
+++ b/linux/nginx/etc/nginx/conf.d/hn.conf
@@ -7,7 +7,7 @@ server {
     autoindex on;
     add_header Onion-Location "http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion$request_uri" always;
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / { try_files $uri $uri/ /index.html; }
@@ -31,7 +31,7 @@ server {
     server_name hn.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://hn.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/img.conf b/linux/nginx/etc/nginx/conf.d/img.conf
index 9a7b557..dc51424 100644
--- a/linux/nginx/etc/nginx/conf.d/img.conf
+++ b/linux/nginx/etc/nginx/conf.d/img.conf
@@ -4,7 +4,7 @@ server {
 	server_name img.cleberg.net;
 	add_header Onion-Location "http://ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/img/;
diff --git a/linux/nginx/etc/nginx/conf.d/irc.conf b/linux/nginx/etc/nginx/conf.d/irc.conf
index 9e85f0b..aeb7f12 100644
--- a/linux/nginx/etc/nginx/conf.d/irc.conf
+++ b/linux/nginx/etc/nginx/conf.d/irc.conf
@@ -3,13 +3,12 @@ server {
 	http2 on;
 	server_name irc.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:9900;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
diff --git a/linux/nginx/etc/nginx/conf.d/ld.conf b/linux/nginx/etc/nginx/conf.d/ld.conf
index 4eacbf7..8070bb6 100644
--- a/linux/nginx/etc/nginx/conf.d/ld.conf
+++ b/linux/nginx/etc/nginx/conf.d/ld.conf
@@ -4,12 +4,11 @@ server {
 	server_name ld.zerolabs.sh  u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion;
 	add_header Onion-Location "http://u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:3004;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name ld.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://ld.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/lt.conf b/linux/nginx/etc/nginx/conf.d/lt.conf
index 9a7dd1a..2ffa405 100644
--- a/linux/nginx/etc/nginx/conf.d/lt.conf
+++ b/linux/nginx/etc/nginx/conf.d/lt.conf
@@ -4,12 +4,11 @@ server {
 	server_name lt.zerolabs.sh  nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion;
 	add_header Onion-Location "http://nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:5000;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name lt.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://lt.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/mz.conf b/linux/nginx/etc/nginx/conf.d/mz.conf
index aa0e6f8..a1e4507 100644
--- a/linux/nginx/etc/nginx/conf.d/mz.conf
+++ b/linux/nginx/etc/nginx/conf.d/mz.conf
@@ -4,12 +4,11 @@ server {
 	server_name mz.zerolabs.sh  ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion;
 	add_header Onion-Location "http://ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:3474;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name mz.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://mz.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/office.conf b/linux/nginx/etc/nginx/conf.d/office.conf
index 94a50c0..4991133 100644
--- a/linux/nginx/etc/nginx/conf.d/office.conf
+++ b/linux/nginx/etc/nginx/conf.d/office.conf
@@ -5,7 +5,7 @@ server {
 	add_header Onion-Location "http://uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion$request_uri" always;
 	root /var/www/office/;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
@@ -36,7 +36,7 @@ server {
     server_name office.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://office.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/org.conf b/linux/nginx/etc/nginx/conf.d/org.conf
index 1e1b700..ce8c96f 100644
--- a/linux/nginx/etc/nginx/conf.d/org.conf
+++ b/linux/nginx/etc/nginx/conf.d/org.conf
@@ -5,7 +5,7 @@ server {
 	add_header Onion-Location "http://7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion$request_uri" always;
 	root /var/www/org/;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
@@ -36,7 +36,7 @@ server {
     server_name org.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://org.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/paste.conf b/linux/nginx/etc/nginx/conf.d/paste.conf
index b47a79b..8b8640d 100644
--- a/linux/nginx/etc/nginx/conf.d/paste.conf
+++ b/linux/nginx/etc/nginx/conf.d/paste.conf
@@ -4,12 +4,11 @@ server {
 	server_name paste.zerolabs.sh  ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion;
 	add_header Onion-Location "http://ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:8084;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name paste.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://paste.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/pb.conf b/linux/nginx/etc/nginx/conf.d/pb.conf
index 32fb3cc..4687789 100644
--- a/linux/nginx/etc/nginx/conf.d/pb.conf
+++ b/linux/nginx/etc/nginx/conf.d/pb.conf
@@ -6,13 +6,12 @@ server {
 	error_log /var/log/nginx/pb.log;
 
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:8745;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
@@ -37,7 +36,7 @@ server {
     server_name pb.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://pb.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/photos.conf b/linux/nginx/etc/nginx/conf.d/photos.conf
index 89a1867..a7c90b4 100644
--- a/linux/nginx/etc/nginx/conf.d/photos.conf
+++ b/linux/nginx/etc/nginx/conf.d/photos.conf
@@ -3,7 +3,7 @@ server {
 	http2 on;
 	server_name photos.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	client_max_body_size 50000M;
@@ -18,7 +18,7 @@ server {
 	proxy_read_timeout 600s;
 	proxy_send_timeout 600s;
 	send_timeout       600s;
-	location / { proxy_pass http://127.0.0.1:2283; }
+	location / { proxy_pass $backend_address; }
 }
 
 server {
diff --git a/linux/nginx/etc/nginx/conf.d/pin.conf b/linux/nginx/etc/nginx/conf.d/pin.conf
index 795947c..7f91436 100644
--- a/linux/nginx/etc/nginx/conf.d/pin.conf
+++ b/linux/nginx/etc/nginx/conf.d/pin.conf
@@ -4,12 +4,11 @@ server {
 	server_name pin.zerolabs.sh  3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion;
 	add_header Onion-Location "http://3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:8086;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name pin.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://pin.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/piped.conf b/linux/nginx/etc/nginx/conf.d/piped.conf
index 9078662..4961144 100644
--- a/linux/nginx/etc/nginx/conf.d/piped.conf
+++ b/linux/nginx/etc/nginx/conf.d/piped.conf
@@ -4,12 +4,11 @@ server {
 	server_name piped.zerolabs.sh pipedapi.zerolabs.sh pipedproxy.zerolabs.sh  5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion;
 	add_header Onion-Location "http://5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:8077;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		proxy_set_header Host $host;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://pipedapi.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/projects.conf b/linux/nginx/etc/nginx/conf.d/projects.conf
index a6930d9..3272536 100644
--- a/linux/nginx/etc/nginx/conf.d/projects.conf
+++ b/linux/nginx/etc/nginx/conf.d/projects.conf
@@ -6,7 +6,7 @@ server {
 	root /var/www/projects/;
 	autoindex on;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
@@ -39,7 +39,7 @@ server {
     server_name projects.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://projects.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/rd.conf b/linux/nginx/etc/nginx/conf.d/rd.conf
index 0e0b4be..778e5e9 100644
--- a/linux/nginx/etc/nginx/conf.d/rd.conf
+++ b/linux/nginx/etc/nginx/conf.d/rd.conf
@@ -4,12 +4,11 @@ server {
 	server_name rd.zerolabs.sh  voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion;
 	add_header Onion-Location "http://voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:2944;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name rd.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://rd.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
index 9550129..0336884 100644
--- a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
+++ b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
@@ -4,9 +4,7 @@ server {
 	server_name www.reminiscecleberg.com;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/policy_strict.conf;
-	ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
-	ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
-	ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem;
+	include custom.d/tls/certificate_files_reminiscecleberg_com.conf;
 	return 301 $scheme://reminiscecleberg.com$request_uri;
 }
 
@@ -18,10 +16,8 @@ server {
 	root /var/www/reminiscecleberg.com/;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/policy_strict.conf;
+	include custom.d/tls/certificate_files_reminiscecleberg_com.conf;
 	include custom.d/basic.conf;
-	ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
-	ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
-	ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem;
 	location / { try_files $uri $uri/ =404; }
 }
 
diff --git a/linux/nginx/etc/nginx/conf.d/rimgo.conf b/linux/nginx/etc/nginx/conf.d/rimgo.conf
index d98fba6..140ce41 100644
--- a/linux/nginx/etc/nginx/conf.d/rimgo.conf
+++ b/linux/nginx/etc/nginx/conf.d/rimgo.conf
@@ -4,12 +4,11 @@ server {
 	server_name rimgo.zerolabs.sh  hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion;
 	add_header Onion-Location "http://hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:3869;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name rimgo.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://rimgo.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/rl.conf b/linux/nginx/etc/nginx/conf.d/rl.conf
index c892924..afabd63 100644
--- a/linux/nginx/etc/nginx/conf.d/rl.conf
+++ b/linux/nginx/etc/nginx/conf.d/rl.conf
@@ -4,13 +4,12 @@ server {
 	server_name rl.zerolabs.sh  s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion;
 	add_header Onion-Location "http://s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:8983;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
@@ -35,7 +34,7 @@ server {
     server_name rl.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://rl.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/rss.conf b/linux/nginx/etc/nginx/conf.d/rss.conf
index 7cbb810..3eccab2 100644
--- a/linux/nginx/etc/nginx/conf.d/rss.conf
+++ b/linux/nginx/etc/nginx/conf.d/rss.conf
@@ -4,7 +4,7 @@ server {
 	http2 on;
 	server_name rss.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/search.conf b/linux/nginx/etc/nginx/conf.d/search.conf
index 6486bf4..00197ee 100644
--- a/linux/nginx/etc/nginx/conf.d/search.conf
+++ b/linux/nginx/etc/nginx/conf.d/search.conf
@@ -4,12 +4,11 @@ server {
 	server_name search.zerolabs.sh  txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion;
 	add_header Onion-Location "http://txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:9191;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		proxy_set_header   Host $host;
 		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
 		proxy_set_header   Upgrade $http_upgrade;
@@ -37,7 +36,7 @@ server {
     server_name search.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://search.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/send.conf b/linux/nginx/etc/nginx/conf.d/send.conf
index 336b25f..8db77db 100644
--- a/linux/nginx/etc/nginx/conf.d/send.conf
+++ b/linux/nginx/etc/nginx/conf.d/send.conf
@@ -4,12 +4,11 @@ server {
 	server_name send.zerolabs.sh 6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion;
 	add_header Onion-Location "http://6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://192.168.0.251:1443;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name send.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://send.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/slash.conf b/linux/nginx/etc/nginx/conf.d/slash.conf
index eb12e08..e613944 100644
--- a/linux/nginx/etc/nginx/conf.d/slash.conf
+++ b/linux/nginx/etc/nginx/conf.d/slash.conf
@@ -4,12 +4,11 @@ server {
 	server_name slash.zerolabs.sh svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion;
 	add_header Onion-Location "http://svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://192.168.0.251:5231;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name slash.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://slash.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/small.conf b/linux/nginx/etc/nginx/conf.d/small.conf
index 6cf31c3..73a61d3 100644
--- a/linux/nginx/etc/nginx/conf.d/small.conf
+++ b/linux/nginx/etc/nginx/conf.d/small.conf
@@ -4,12 +4,11 @@ server {
 	server_name small.zerolabs.sh  w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion;
 	add_header Onion-Location "http://w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion$request_uri" always;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
-		set $upstream http://127.0.0.1:8002;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/basic.conf;
 	}
 	include custom.d/security/robots_index_only.conf;
@@ -33,7 +32,7 @@ server {
     server_name small.cleberg.net;
 
     include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files.conf;
+    include custom.d/tls/certificate_files_cleberg_net.conf;
     include custom.d/tls/policy_strict.conf;
 
     return 301 https://small.zerolabs.sh$request_uri;
diff --git a/linux/nginx/etc/nginx/conf.d/ssh.conf b/linux/nginx/etc/nginx/conf.d/ssh.conf
index 4d8b3bb..2c25cdf 100644
--- a/linux/nginx/etc/nginx/conf.d/ssh.conf
+++ b/linux/nginx/etc/nginx/conf.d/ssh.conf
@@ -3,13 +3,12 @@ server {
 	http2 on;
 	server_name ssh.zerolabs.sh;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files.conf;
+	include custom.d/tls/certificate_files_cleberg_net.conf;
 	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
-		set $upstream http://127.0.0.1:8169;
-		proxy_pass $upstream;
+		proxy_pass $backend_address;
 		include custom.d/reverse_proxy/authelia_request.conf;
 		include custom.d/reverse_proxy/basic.conf;
 	}
diff --git a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
index a5295c7..3ea806d 100644
--- a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
+++ b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
@@ -4,9 +4,7 @@ server {
         server_name www.zerolabs.sh;
         include custom.d/tls/ssl_engine.conf;
         include custom.d/tls/policy_strict.conf;
-        ssl_certificate         /etc/letsencrypt/live/zerolabs.sh/fullchain.pem;
-        ssl_certificate_key     /etc/letsencrypt/live/zerolabs.sh/privkey.pem;
-        ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem;
+        include custom.d/tls/certificate_files_zerolabs_sh.conf;
         return 301 $scheme://zerolabs.sh$request_uri;
 }
 
@@ -18,10 +16,8 @@ server {
         root /var/www/zerolabs.sh/;
         include custom.d/tls/ssl_engine.conf;
         include custom.d/tls/policy_strict.conf;
+        include custom.d/tls/certificate_files_zerolabs_sh.conf;
         include custom.d/basic.conf;
-        ssl_certificate         /etc/letsencrypt/live/zerolabs.sh/fullchain.pem;
-        ssl_certificate_key     /etc/letsencrypt/live/zerolabs.sh/privkey.pem;
-        ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem;
         location / { try_files $uri $uri/ =404; }
 }
 
diff --git a/linux/nginx/etc/nginx/custom.d/http/backend_address.conf b/linux/nginx/etc/nginx/custom.d/http/backend_address.conf
new file mode 100644
index 0000000..77837f4
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/http/backend_address.conf
@@ -0,0 +1,145 @@
+# Upstream URL per Host (clearnet and matching .onion listeners). Used as:
+#   proxy_pass $backend_address;
+map $host $backend_address {
+  hostnames;
+
+  # --- ao
+  7lyqrn4ofxdq7lfporviu44zpc42wooh2bqazfhvpscgwby2vcwldzad.onion http://127.0.0.1:9380;
+  ao.cleberg.net      http://127.0.0.1:9380;
+  ao.zerolabs.sh      http://127.0.0.1:9380;
+
+  # --- art
+  art.cleberg.net     http://127.0.0.1:3003;
+  art.zerolabs.sh     http://127.0.0.1:3003;
+  mplqs2jxkjd5wxak3zjv55oxyadf4vwzx6ksgj4ztftndjl6elgsf4qd.onion http://127.0.0.1:3003;
+
+  # --- auth (cleberg hostname reserved for future use)
+  auth.cleberg.net    http://127.0.0.1:9092;
+  auth.zerolabs.sh    http://127.0.0.1:9092;
+
+  # --- br
+  br.cleberg.net      http://127.0.0.1:3030;
+  br.zerolabs.sh      http://127.0.0.1:3030;
+  pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion http://127.0.0.1:3030;
+
+  # --- bt
+  bt.cleberg.net      http://127.0.0.1:9091;
+  bt.zerolabs.sh      http://127.0.0.1:9091;
+
+  # --- bw
+  bw.cleberg.net      http://127.0.0.1:10416;
+  bw.zerolabs.sh      http://127.0.0.1:10416;
+  z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion http://127.0.0.1:10416;
+
+  # --- cc
+  cc.cleberg.net      http://127.0.0.1:8111;
+  cc.zerolabs.sh      http://127.0.0.1:8111;
+  gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion http://127.0.0.1:8111;
+
+  # --- ddns
+  ddns.cleberg.net    http://127.0.0.1:8097;
+  ddns.zerolabs.sh    http://127.0.0.1:8097;
+
+  # --- gh
+  gh.cleberg.net      http://192.168.0.251:3039;
+  gh.zerolabs.sh      http://192.168.0.251:3039;
+
+  # --- gramps
+  gramps.cleberg.net  http://127.0.0.1:5566;
+
+  # --- ha
+  ha.cleberg.net      http://192.168.0.214:8123;
+  ha.zerolabs.sh      http://192.168.0.214:8123;
+
+  # --- hat
+  hat.cleberg.net     http://192.168.0.251:3991;
+  hat.zerolabs.sh     http://192.168.0.251:3991;
+  jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion http://192.168.0.251:3991;
+
+  # --- irc
+  irc.cleberg.net     http://127.0.0.1:9900;
+  irc.zerolabs.sh     http://127.0.0.1:9900;
+
+  # --- ld
+  ld.cleberg.net      http://127.0.0.1:3004;
+  ld.zerolabs.sh      http://127.0.0.1:3004;
+  u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion http://127.0.0.1:3004;
+
+  # --- lt
+  lt.cleberg.net      http://127.0.0.1:5000;
+  lt.zerolabs.sh      http://127.0.0.1:5000;
+  nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion http://127.0.0.1:5000;
+
+  # --- mz
+  mz.cleberg.net      http://127.0.0.1:3474;
+  mz.zerolabs.sh      http://127.0.0.1:3474;
+  ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion http://127.0.0.1:3474;
+
+  # --- paste
+  paste.cleberg.net   http://127.0.0.1:8084;
+  paste.zerolabs.sh   http://127.0.0.1:8084;
+  ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion http://127.0.0.1:8084;
+
+  # --- pb
+  pb.cleberg.net      http://127.0.0.1:8745;
+  pb.zerolabs.sh      http://127.0.0.1:8745;
+
+  # --- photos
+  photos.cleberg.net  http://127.0.0.1:2283;
+
+  # --- pin
+  pin.cleberg.net     http://127.0.0.1:8086;
+  pin.zerolabs.sh     http://127.0.0.1:8086;
+  3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion http://127.0.0.1:8086;
+
+  # --- piped
+  piped.cleberg.net     http://127.0.0.1:8077;
+  piped.zerolabs.sh     http://127.0.0.1:8077;
+  pipedapi.cleberg.net  http://127.0.0.1:8077;
+  pipedapi.zerolabs.sh  http://127.0.0.1:8077;
+  pipedproxy.cleberg.net  http://127.0.0.1:8077;
+  pipedproxy.zerolabs.sh  http://127.0.0.1:8077;
+  5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion http://127.0.0.1:8077;
+
+  # --- rd
+  rd.cleberg.net      http://127.0.0.1:2944;
+  rd.zerolabs.sh      http://127.0.0.1:2944;
+  voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion http://127.0.0.1:2944;
+
+  # --- rimgo
+  rimgo.cleberg.net   http://127.0.0.1:3869;
+  rimgo.zerolabs.sh   http://127.0.0.1:3869;
+  hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion http://127.0.0.1:3869;
+
+  # --- rl
+  rl.cleberg.net      http://127.0.0.1:8983;
+  rl.zerolabs.sh      http://127.0.0.1:8983;
+  s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion http://127.0.0.1:8983;
+
+  # --- search
+  search.cleberg.net  http://127.0.0.1:9191;
+  search.zerolabs.sh  http://127.0.0.1:9191;
+  txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion http://127.0.0.1:9191;
+
+  # --- send
+  send.cleberg.net    http://192.168.0.251:1443;
+  send.zerolabs.sh    http://192.168.0.251:1443;
+  6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion http://192.168.0.251:1443;
+
+  # --- slash
+  slash.cleberg.net   http://192.168.0.251:5231;
+  slash.zerolabs.sh   http://192.168.0.251:5231;
+  svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion http://192.168.0.251:5231;
+
+  # --- small
+  small.cleberg.net   http://127.0.0.1:8002;
+  small.zerolabs.sh   http://127.0.0.1:8002;
+  w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion http://127.0.0.1:8002;
+
+  # --- ssh
+  ssh.cleberg.net     http://127.0.0.1:8169;
+  ssh.zerolabs.sh     http://127.0.0.1:8169;
+
+  # --- wyl (reserved)
+  wyl.cleberg.net     http://192.168.0.251:8840;
+}
diff --git a/linux/nginx/etc/nginx/custom.d/http/content_type_maps.conf b/linux/nginx/etc/nginx/custom.d/http/content_type_maps.conf
new file mode 100644
index 0000000..8f00d12
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/http/content_type_maps.conf
@@ -0,0 +1,83 @@
+# Response header maps (see nginx.conf for context).
+# Add Cache-Control.
+map $sent_http_content_type $cache_control {
+  default                           "public, immutable, stale-while-revalidate";
+
+  # No content
+  ""                                "no-store";
+
+  # Manifest files
+  ~*application/manifest\+json      "public";
+  ~*text/cache-manifest             ""; # `no-cache` (*)
+
+  # Assets
+  ~*image/svg\+xml                  "public, immutable, stale-while-revalidate";
+
+  # Data interchange
+  ~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate";
+
+  # Documents
+  ~*text/html                       "private, must-revalidate";
+  ~*text/markdown                   "private, must-revalidate";
+  ~*text/calendar                   "private, must-revalidate";
+
+  # Data
+  ~*json                            ""; # `no-cache` (*)
+  ~*xml                             ""; # `no-cache` (*)
+}
+
+# Add X-Frame-Options for HTML documents.
+map $sent_http_content_type $x_frame_options {
+  ~*text/html DENY;
+}
+
+# Add Content-Security-Policy for HTML documents.
+map $sent_http_content_type $content_security_policy {
+  ~*text/(html|javascript)|application/pdf|xml "
+    default-src 'self';
+    img-src 'self' https://img.cleberg.net;
+    base-uri 'none';
+    form-action 'self';
+    frame-ancestors 'none';
+    object-src 'none';
+    upgrade-insecure-requests
+  ";
+}
+
+# Add Permissions-Policy for HTML documents.
+map $sent_http_content_type $permissions_policy {
+  ~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()";
+}
+
+# Add Referrer-Policy for HTML documents.
+map $sent_http_content_type $referrer_policy {
+  ~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin";
+}
+
+# Add Cross-Origin-Policies for HTML documents.
+# Cross-Origin-Embedder-Policy
+map $sent_http_content_type $coep_policy {
+  ~*text/(html|javascript)|application/pdf|xml "require-corp";
+}
+# Cross-Origin-Opener-Policy
+map $sent_http_content_type $coop_policy {
+  ~*text/(html|javascript)|application/pdf|xml "same-origin";
+}
+# Cross-Origin-Resource-Policy
+map $sent_http_content_type $corp_policy {
+  ~*text/(html|javascript)|application/pdf|xml "same-origin";
+}
+
+# Add Access-Control-Allow-Origin.
+map $sent_http_content_type $cors {
+  # Images
+  ~*image/                        "*";
+
+  # Web fonts
+  ~*font/                         "*";
+  ~*application/vnd.ms-fontobject "*";
+  ~*application/x-font-ttf        "*";
+  ~*application/font-woff         "*";
+  ~*application/x-font-woff       "*";
+  ~*application/font-woff2        "*";
+}
diff --git a/linux/nginx/etc/nginx/custom.d/sites/cleberg_net_static_locations.conf b/linux/nginx/etc/nginx/custom.d/sites/cleberg_net_static_locations.conf
new file mode 100644
index 0000000..b8764b3
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/sites/cleberg_net_static_locations.conf
@@ -0,0 +1,27 @@
+location /org/ {
+	internal;
+	alias /var/www/cleberg.net/org/;
+	default_type text/plain;
+	add_header Content-Type "text/plain; charset=utf-8";
+}
+
+location / {
+	try_files $uri $uri/ =404;
+}
+
+location /blog/ {
+	rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent;
+	if ($http_accept ~* "text/markdown") {
+		rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last;
+	}
+}
+
+location ~ ^/([^/]+)\.html$ {
+	if ($http_accept ~* "text/markdown") {
+		rewrite ^/([^/]+)\.html$ /org/$1.org last;
+	}
+	try_files $uri =404;
+}
+
+location /atom.xml { return 301 $scheme://$host/feed.xml; }
+location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; }
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
index 741e024..7726591 100644
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
@@ -1,33 +1,2 @@
-# ----------------------------------------------------------------------
-# | Certificate files                                                  |
-# ----------------------------------------------------------------------
-
-# This default SSL certificate will be served whenever the client lacks support
-# for SNI (Server Name Indication).
-#
-# (1) Certificate and key files location
-#     The certificate file can contain an intermediate certificate.
-#
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
-#
-# (2) Intermediate certificate location if loaded certificate (1) does not
-#     contain intermediate certificate when enabling OCSP stapling.
-#
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate
-#
-# (3) CA certificate file location for client certificate authentication.
-#
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate
-
-# (1)
-# ssl_certificate /etc/nginx/certs/default.crt;
-# ssl_certificate_key /etc/nginx/certs/default.key;
-ssl_certificate         /etc/letsencrypt/live/cleberg.net/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/cleberg.net/privkey.pem;
-
-# (2)
-# ssl_trusted_certificate /path/to/ca.crt;
-ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem;
-
-# (3)
-# ssl_client_certificate /etc/nginx/default_ssl.crt;
+# Legacy include name: cleberg.net certificate (most zerolabs/cleberg.net vhosts).
+include certificate_files_cleberg_net.conf;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf
new file mode 100644
index 0000000..d74f2c8
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf
@@ -0,0 +1,3 @@
+ssl_certificate         /etc/letsencrypt/live/cleberg.dev/fullchain.pem;
+ssl_certificate_key     /etc/letsencrypt/live/cleberg.dev/privkey.pem;
+ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf
new file mode 100644
index 0000000..a94c829
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf
@@ -0,0 +1,3 @@
+ssl_certificate         /etc/letsencrypt/live/cleberg.io/fullchain.pem;
+ssl_certificate_key     /etc/letsencrypt/live/cleberg.io/privkey.pem;
+ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf
new file mode 100644
index 0000000..afd7aa9
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf
@@ -0,0 +1,16 @@
+# ----------------------------------------------------------------------
+# | Certificate files — cleberg.net                                    |
+# ----------------------------------------------------------------------
+
+# This default SSL certificate will be served whenever the client lacks support
+# for SNI (Server Name Indication).
+#
+# (1) Certificate and key files location
+#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
+#
+# (2) Intermediate certificate for OCSP stapling
+#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate
+
+ssl_certificate         /etc/letsencrypt/live/cleberg.net/fullchain.pem;
+ssl_certificate_key     /etc/letsencrypt/live/cleberg.net/privkey.pem;
+ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf
new file mode 100644
index 0000000..00f9ef7
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf
@@ -0,0 +1,3 @@
+ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
+ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
+ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf
new file mode 100644
index 0000000..3a6ba1a
--- /dev/null
+++ b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf
@@ -0,0 +1,3 @@
+ssl_certificate         /etc/letsencrypt/live/zerolabs.sh/fullchain.pem;
+ssl_certificate_key     /etc/letsencrypt/live/zerolabs.sh/privkey.pem;
+ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem;
diff --git a/linux/nginx/etc/nginx/nginx.conf b/linux/nginx/etc/nginx/nginx.conf
index 47a5032..71b4bde 100644
--- a/linux/nginx/etc/nginx/nginx.conf
+++ b/linux/nginx/etc/nginx/nginx.conf
@@ -106,133 +106,12 @@ http {
   # Specify file cache expiration.
   include custom.d/web_performance/cache_expiration.conf;
 
-  # Add Cache-Control.
-  # custom.d/web_performance/cache-control.conf
-  map $sent_http_content_type $cache_control {
-    default                           "public, immutable, stale-while-revalidate";
-
-    # No content
-    ""                                "no-store";
-
-    # Manifest files
-    ~*application/manifest\+json      "public";
-    ~*text/cache-manifest             ""; # `no-cache` (*)
-
-    # Assets
-    ~*image/svg\+xml                  "public, immutable, stale-while-revalidate";
-
-    # Data interchange
-    ~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate";
-
-    # Documents
-    ~*text/html                       "private, must-revalidate";
-    ~*text/markdown                   "private, must-revalidate";
-    ~*text/calendar                   "private, must-revalidate";
-
-    # Data
-    ~*json                            ""; # `no-cache` (*)
-    ~*xml                             ""; # `no-cache` (*)
-  }
-
-  # Add X-Frame-Options for HTML documents.
-  # custom.d/security/x-frame-options.conf
-  map $sent_http_content_type $x_frame_options {
-    ~*text/html DENY;
-  }
-
-  # Add Content-Security-Policy for HTML documents.
-  # custom.d/security/content-security-policy.conf
-  map $sent_http_content_type $content_security_policy {
-    ~*text/(html|javascript)|application/pdf|xml "
-      default-src 'self';
-      img-src 'self' https://img.cleberg.net;
-      base-uri 'none';
-      form-action 'self';
-      frame-ancestors 'none';
-      object-src 'none';
-      upgrade-insecure-requests
-    ";
-  }
-
-  # Add Permissions-Policy for HTML documents.
-  # custom.d/security/permissions-policy.conf
-  map $sent_http_content_type $permissions_policy {
-    ~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()";
-  }
-
-  # Add Referrer-Policy for HTML documents.
-  # custom.d/security/referrer-policy.conf
-  map $sent_http_content_type $referrer_policy {
-    ~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin";
-  }
-
-  # Add Cross-Origin-Policies for HTML documents.
-  # custom.d/security/cross-origin-policy.conf
-  # Cross-Origin-Embedder-Policy
-  map $sent_http_content_type $coep_policy {
-    ~*text/(html|javascript)|application/pdf|xml "require-corp";
-  }
-  # Cross-Origin-Opener-Policy
-  map $sent_http_content_type $coop_policy {
-    ~*text/(html|javascript)|application/pdf|xml "same-origin";
-  }
-  # Cross-Origin-Resource-Policy
-  map $sent_http_content_type $corp_policy {
-    ~*text/(html|javascript)|application/pdf|xml "same-origin";
-  }
-
-  # Add Access-Control-Allow-Origin.
-  # custom.d/cross-origin/requests.conf
-  map $sent_http_content_type $cors {
-    # Images
-    ~*image/                        "*";
-
-    # Web fonts
-    ~*font/                         "*";
-    ~*application/vnd.ms-fontobject "*";
-    ~*application/x-font-ttf        "*";
-    ~*application/font-woff         "*";
-    ~*application/x-font-woff       "*";
-    ~*application/font-woff2        "*";
-  }
+  include custom.d/http/content_type_maps.conf;
 
   # Fix for onion links
   server_names_hash_bucket_size 128;
 
-  map $host $backend_address {
-    hostnames;
-
-    ao.cleberg.net      http://127.0.0.1:9380;
-    art.cleberg.net     http://127.0.0.1:3003;
-    auth.cleberg.net    http://127.0.0.1:9092;
-    br.cleberg.net      http://127.0.0.1:3030;
-    bt.cleberg.net      http://127.0.0.1:9091;
-    bw.cleberg.net      http://127.0.0.1:10416;
-    cc.cleberg.net      http://127.0.0.1:8111;
-    ddns.cleberg.net    http://127.0.0.1:8097;
-    gh.cleberg.net      http://192.168.0.251:3039;
-    ha.cleberg.net      http://192.168.0.214:8123;
-    hat.cleberg.net     http://192.168.0.251:3991;
-    irc.cleberg.net     http://192.168.0.251:9900;
-    ld.cleberg.net      http://127.0.0.1:3004;
-    lt.cleberg.net      http://127.0.0.1:5000;
-    mz.cleberg.net      http://127.0.0.1:3474;
-    paste.cleberg.net   http://127.0.0.1:8084;
-    pb.cleberg.net      http://127.0.0.1:8745;
-    photos.cleberg.net  http://127.0.0.1:2283;
-    pin.cleberg.net     http://127.0.0.1:8086;
-    piped.cleberg.net   http://127.0.0.1:8077;
-    rd.cleberg.net      http://127.0.0.1:5758;
-    rimgo.cleberg.net   http://127.0.0.1:3869;
-    rl.cleberg.net      http://192.168.0.251:8983;
-    rss.cleberg.net     http://192.168.0.251:8081;
-    search.cleberg.net  http://127.0.0.1:9191;
-    send.cleberg.net    http://127.0.0.1:1443;
-    slash.cleberg.net   http://192.168.0.251:5231;
-    small.cleberg.net   http://127.0.0.1:8002;
-    ssh.cleberg.net     http://127.0.0.1:8169;
-    wyl.cleberg.net     http://192.168.0.251:8840;
-  }
+  include custom.d/http/backend_address.conf;
 
   # Include files in the conf.d folder.
   # `server` configuration files should be placed in the conf.d folder.
author	Christian Cleberg <[email protected]>	2026-04-15 18:52:24 -0500
committer	Christian Cleberg <[email protected]>	2026-04-15 18:52:24 -0500
commit	e4433473801de1249845fe183d93095652c159ea (patch)
tree	dafdb86b475534c4ee001fef84264adf49c957f3
parent	5a143ea3c0e6436e010299b2007c16b6aa6be569 (diff)
download	dotfiles-e4433473801de1249845fe183d93095652c159ea.tar.gz dotfiles-e4433473801de1249845fe183d93095652c159ea.tar.bz2 dotfiles-e4433473801de1249845fe183d93095652c159ea.zip