Merge pull request #1 from ccleberg/codex/update-nginx-conf.d-files-port-configuration

nginx: move vhosts to high ports, remove SSL includes, add cleberg.net redirects

45 files changed, 208 insertions, 868 deletions

diff --git a/linux/nginx/etc/nginx/conf.d/1kb.conf b/linux/nginx/etc/nginx/conf.d/1kb.conf
index 4632b68..f12fe40 100644
--- a/linux/nginx/etc/nginx/conf.d/1kb.conf
+++ b/linux/nginx/etc/nginx/conf.d/1kb.conf
@@ -1,7 +1,6 @@
 server {
-    listen 443 ssl;
-    http2 on;
-    server_name 1kb.zerolabs.sh;
+    listen 10001;
+    server_name 1kb.zerolabs.sh 1kb.cleberg.net;
 
     if ($host = 1kb.cleberg.net) {
         return 301 https://1kb.zerolabs.sh$request_uri;
@@ -18,8 +17,6 @@ server {
     gzip_vary off;
     charset off;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_zerolabs_sh.conf;
 
     location = / {
         try_files /index.html =404;
@@ -30,8 +27,3 @@ server {
     }
 }
 
-server {
-    listen 80;
-    server_name 1kb.zerolabs.sh 1kb.cleberg.net;
-    return 301 https://1kb.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/ao.conf b/linux/nginx/etc/nginx/conf.d/ao.conf
index d764c6b..6237830 100644
--- a/linux/nginx/etc/nginx/conf.d/ao.conf
+++ b/linux/nginx/etc/nginx/conf.d/ao.conf
@@ -1,6 +1,5 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10002;
 	server_name ao.zerolabs.sh ao.cleberg.net;
 
 	if ($host = ao.cleberg.net) {
@@ -8,9 +7,6 @@ server {
 	}
 
 	add_header Onion-Location "http://7lyqrn4ofxdq7lfporviu44zpc42wooh2bqazfhvpscgwby2vcwldzad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -19,14 +15,4 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name ao.zerolabs.sh;
-    return 301 https://ao.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name ao.cleberg.net;
-    return 301 https://ao.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/art.conf b/linux/nginx/etc/nginx/conf.d/art.conf
index f2b3936..b4ab4fd 100644
--- a/linux/nginx/etc/nginx/conf.d/art.conf
+++ b/linux/nginx/etc/nginx/conf.d/art.conf
@@ -1,6 +1,5 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10003;
 	server_name art.cleberg.net art.zerolabs.sh  mplqs2jxkjd5wxak3zjv55oxyadf4vwzx6ksgj4ztftndjl6elgsf4qd.onion;
 	add_header Onion-Location "http://mplqs2jxkjd5wxak3zjv55oxyadf4vwzx6ksgj4ztftndjl6elgsf4qd.onion$request_uri" always;
 
@@ -8,9 +7,6 @@ server {
 		return 301 https://art.zerolabs.sh$request_uri;
 	}
 
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -19,8 +15,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name art.zerolabs.sh art.cleberg.net;
-    return 301 https://art.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/auth.conf b/linux/nginx/etc/nginx/conf.d/auth.conf
index 5987bd7..eccd7a6 100644
--- a/linux/nginx/etc/nginx/conf.d/auth.conf
+++ b/linux/nginx/etc/nginx/conf.d/auth.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name auth.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10004;
+	server_name auth.zerolabs.sh auth.cleberg.net;
+
+	if ($host = auth.cleberg.net) {
+	    return 301 https://auth.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -13,8 +13,3 @@ server {
 	location /api/verify { proxy_pass $backend_address; }
 }
 
-server {
-    listen 80;
-    server_name auth.zerolabs.sh;
-    return 301 https://auth.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/bb.conf b/linux/nginx/etc/nginx/conf.d/bb.conf
index b395511..d5523f5 100644
--- a/linux/nginx/etc/nginx/conf.d/bb.conf
+++ b/linux/nginx/etc/nginx/conf.d/bb.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name bb.zerolabs.sh;
+	listen 10005;
+	server_name bb.zerolabs.sh bb.cleberg.net;
+
+	if ($host = bb.cleberg.net) {
+	    return 301 https://bb.zerolabs.sh$request_uri;
+	}
 
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_zerolabs_sh.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -17,8 +17,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name bb.zerolabs.sh;
-    return 301 https://bb.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/br.conf b/linux/nginx/etc/nginx/conf.d/br.conf
index a917ec1..55c6ef4 100644
--- a/linux/nginx/etc/nginx/conf.d/br.conf
+++ b/linux/nginx/etc/nginx/conf.d/br.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name br.zerolabs.sh  pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion;
+	listen 10006;
+	server_name br.zerolabs.sh pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion br.cleberg.net;
+
+	if ($host = br.cleberg.net) {
+	    return 301 https://br.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
     location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
     include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name br.zerolabs.sh;
-    return 301 https://br.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name br.cleberg.net;
-    return 301 https://br.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name br.cleberg.net;
-
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://br.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/bt.conf b/linux/nginx/etc/nginx/conf.d/bt.conf
index 1d5ed84..f12e072 100644
--- a/linux/nginx/etc/nginx/conf.d/bt.conf
+++ b/linux/nginx/etc/nginx/conf.d/bt.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name bt.zerolabs.sh;
+	listen 10007;
+	server_name bt.zerolabs.sh bt.cleberg.net;
+
+	if ($host = bt.cleberg.net) {
+	    return 301 https://bt.zerolabs.sh$request_uri;
+	}
 
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 
 	location /authelia {
@@ -34,26 +34,5 @@ server {
 	}
 }
 
-server {
-    listen 80;
-    server_name bt.zerolabs.sh;
-    return 301 https://bt.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name bt.cleberg.net;
-    return 301 https://bt.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name bt.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://bt.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/bw.conf b/linux/nginx/etc/nginx/conf.d/bw.conf
index b78fee8..fc238d1 100644
--- a/linux/nginx/etc/nginx/conf.d/bw.conf
+++ b/linux/nginx/etc/nginx/conf.d/bw.conf
@@ -1,11 +1,11 @@
 server {
-    listen 443 ssl;
-    http2 on;
-    server_name bw.zerolabs.sh  z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion;
+    listen 10008;
+    server_name bw.zerolabs.sh z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion bw.cleberg.net;
+
+    if ($host = bw.cleberg.net) {
+        return 301 https://bw.zerolabs.sh$request_uri;
+    }
 	add_header Onion-Location "http://z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion$request_uri" always;
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / {
              proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
     include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name bw.zerolabs.sh;
-    return 301 https://bw.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name bw.cleberg.net;
-    return 301 https://bw.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name bw.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://bw.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/cc.conf b/linux/nginx/etc/nginx/conf.d/cc.conf
index 3db5cff..f2a62ea 100644
--- a/linux/nginx/etc/nginx/conf.d/cc.conf
+++ b/linux/nginx/etc/nginx/conf.d/cc.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name cc.zerolabs.sh  gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion;
+	listen 10009;
+	server_name cc.zerolabs.sh gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion cc.cleberg.net;
+
+	if ($host = cc.cleberg.net) {
+	    return 301 https://cc.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name cc.zerolabs.sh;
-    return 301 https://cc.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name cc.cleberg.net;
-    return 301 https://cc.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name cc.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://cc.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
index 1030307..088c9ff 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
@@ -1,28 +1,10 @@
-server {
-        listen 443 ssl;
-        http2 on;
-        server_name www.cleberg.dev;
-        include custom.d/tls/ssl_engine.conf;
-        include custom.d/tls/policy_strict.conf;
-        include custom.d/tls/certificate_files_cleberg_dev.conf;
-        return 301 $scheme://cleberg.dev$request_uri;
-}
 
 
 server {
-        listen 443 ssl;
-        http2 on;
+        listen 10010;
         server_name cleberg.dev;
         root /var/www/cleberg.dev/;
-        include custom.d/tls/ssl_engine.conf;
-        include custom.d/tls/policy_strict.conf;
-        include custom.d/tls/certificate_files_cleberg_dev.conf;
         include custom.d/basic.conf;
         location / { try_files $uri $uri/ =404; }
 }
 
-server {
-        listen 80;
-        server_name www.cleberg.dev cleberg.dev;
-        return 301 https://cleberg.dev$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
index f3625f3..8b13789 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
@@ -1,16 +1 @@
-server {
-	listen 443 ssl;
-	http2 on;
-	server_name cleberg.io;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_strict.conf;
-	include custom.d/tls/certificate_files_cleberg_io.conf;
-	include custom.d/basic.conf;
-	return 301 https://cleberg.net;
-}
 
-server {
-	listen 80;
-	server_name www.cleberg.io cleberg.io;
-	return 301 https://cleberg.io$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
index c4671b0..857e183 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
@@ -1,11 +1,7 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10011;
 	server_name cleberg.net;
     error_log /var/log/nginx/cleberg.net.error.log;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	include custom.d/security/strict-transport-security.conf;
 	include custom.d/security/content-security-policy.conf;
@@ -18,12 +14,8 @@ server {
 }
 
 server {
-        listen 443 ssl;
-	http2 on;
+        listen 10012;
 	server_name hutch.cleberg.net;
-        include custom.d/tls/ssl_engine.conf;
-        include custom.d/tls/certificate_files_cleberg_net.conf;
-        include custom.d/tls/policy_strict.conf;
         include custom.d/basic.conf;
         include custom.d/security/strict-transport-security.conf;
         include custom.d/security/content-security-policy.conf;
@@ -39,7 +31,7 @@ server {
 }
 
 server {
-    listen 127.0.0.1:8090;
+    listen 10013;
     server_name paske4urhs6nttrtlkuwa5cowum3fjkc6yv6kl4ncx3mjxcd77764nqd.onion;
     include custom.d/basic.conf;
     root /var/www/cleberg.net/;
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
index 062318b..8b13789 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
@@ -1,8 +1 @@
-server {
-    listen 80;
-    server_name .cleberg.net;
-    if ($host = www.cleberg.net) {
-        return 301 https://cleberg.net$request_uri;
-    }
-    return 301 https://$host$request_uri;
-}
+
diff --git a/linux/nginx/etc/nginx/conf.d/cv.conf b/linux/nginx/etc/nginx/conf.d/cv.conf
index a7230f8..5cbece2 100644
--- a/linux/nginx/etc/nginx/conf.d/cv.conf
+++ b/linux/nginx/etc/nginx/conf.d/cv.conf
@@ -1,11 +1,7 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10014;
 	server_name cv.cleberg.net;
 	add_header Onion-Location "http://xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/cv/;
 	autoindex on;
@@ -13,7 +9,7 @@ server {
 }
 
 server {
-    listen 127.0.0.1:8081;
+    listen 10015;
     server_name xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion;
     include custom.d/basic.conf;
     root /var/www/cv/;
diff --git a/linux/nginx/etc/nginx/conf.d/ddns.conf b/linux/nginx/etc/nginx/conf.d/ddns.conf
index b1abc2f..230a2bc 100644
--- a/linux/nginx/etc/nginx/conf.d/ddns.conf
+++ b/linux/nginx/etc/nginx/conf.d/ddns.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name ddns.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10016;
+	server_name ddns.zerolabs.sh ddns.cleberg.net;
+
+	if ($host = ddns.cleberg.net) {
+	    return 301 https://ddns.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -15,8 +15,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name ddns.zerolabs.sh;
-    return 301 https://ddns.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/files.conf b/linux/nginx/etc/nginx/conf.d/files.conf
index 3419310..7fc7247 100644
--- a/linux/nginx/etc/nginx/conf.d/files.conf
+++ b/linux/nginx/etc/nginx/conf.d/files.conf
@@ -1,11 +1,7 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10017;
 	server_name files.cleberg.net;
 	add_header Onion-Location "http://yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/files/;
 	autoindex on;
@@ -13,7 +9,7 @@ server {
 }
 
 server {
-    listen 127.0.0.1:8082;
+    listen 10018;
     server_name yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion;
     include custom.d/basic.conf;
     root /var/www/files/;
@@ -21,8 +17,3 @@ server {
     location / { try_files $uri $uri/ /index.html; }
 }
 
-server {
-    listen 80;
-    server_name files.cleberg.net;
-    return 301 https://files.cleberg.net$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/gh.conf b/linux/nginx/etc/nginx/conf.d/gh.conf
index 8f6ab22..161ad83 100644
--- a/linux/nginx/etc/nginx/conf.d/gh.conf
+++ b/linux/nginx/etc/nginx/conf.d/gh.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name gh.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10019;
+	server_name gh.zerolabs.sh gh.cleberg.net;
+
+	if ($host = gh.cleberg.net) {
+	    return 301 https://gh.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -13,26 +13,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name gh.zerolabs.sh;
-    return 301 https://gh.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name gh.cleberg.net;
-    return 301 https://gh.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name gh.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://gh.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/gramps.conf b/linux/nginx/etc/nginx/conf.d/gramps.conf
index 7c60488..fec05c4 100644
--- a/linux/nginx/etc/nginx/conf.d/gramps.conf
+++ b/linux/nginx/etc/nginx/conf.d/gramps.conf
@@ -1,10 +1,6 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10020;
 	server_name gramps.cleberg.net;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -15,8 +11,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name gramps.cleberg.net;
-    return 301 https://gramps.cleberg.net$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/ha.conf b/linux/nginx/etc/nginx/conf.d/ha.conf
index 5ee6694..b27225b 100644
--- a/linux/nginx/etc/nginx/conf.d/ha.conf
+++ b/linux/nginx/etc/nginx/conf.d/ha.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name ha.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10021;
+	server_name ha.zerolabs.sh ha.cleberg.net;
+
+	if ($host = ha.cleberg.net) {
+	    return 301 https://ha.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -19,8 +19,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name ha.zerolabs.sh;
-    return 301 https://ha.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/hat.conf b/linux/nginx/etc/nginx/conf.d/hat.conf
index 7a28e67..0eaa83e 100644
--- a/linux/nginx/etc/nginx/conf.d/hat.conf
+++ b/linux/nginx/etc/nginx/conf.d/hat.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name hat.zerolabs.sh  jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion;
+	listen 10022;
+	server_name hat.zerolabs.sh jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion hat.cleberg.net;
+
+	if ($host = hat.cleberg.net) {
+	    return 301 https://hat.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
     include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name hat.zerolabs.sh;
-    return 301 https://hat.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name hat.cleberg.net;
-    return 301 https://hat.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name hat.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://hat.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/hn.conf b/linux/nginx/etc/nginx/conf.d/hn.conf
index e57dff9..f993a69 100644
--- a/linux/nginx/etc/nginx/conf.d/hn.conf
+++ b/linux/nginx/etc/nginx/conf.d/hn.conf
@@ -1,38 +1,17 @@
 server {
-    listen 443 ssl;
-    http2 on;
-    listen 127.0.0.1:8093;
-    server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion;
+    listen 10023;
+    listen 10024;
+    server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion hn.cleberg.net;
+
+    if ($host = hn.cleberg.net) {
+        return 301 https://hn.zerolabs.sh$request_uri;
+    }
     root /var/www/hn/output/;
     autoindex on;
     add_header Onion-Location "http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion$request_uri" always;
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / { try_files $uri $uri/ /index.html; }
 }
 
-server {
-    listen 80;
-    server_name hn.zerolabs.sh;
-    return 301 https://hn.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name hn.cleberg.net;
-    return 301 https://hn.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name hn.cleberg.net;
-
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://hn.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/img.conf b/linux/nginx/etc/nginx/conf.d/img.conf
index dc51424..3b13c8a 100644
--- a/linux/nginx/etc/nginx/conf.d/img.conf
+++ b/linux/nginx/etc/nginx/conf.d/img.conf
@@ -1,11 +1,7 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10025;
 	server_name img.cleberg.net;
 	add_header Onion-Location "http://ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/img/;
 	autoindex on;
@@ -13,7 +9,7 @@ server {
 }
 
 server {
-    listen 127.0.0.1:8083;
+    listen 10026;
     server_name ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion;
     include custom.d/basic.conf;
     root /var/www/img/;
diff --git a/linux/nginx/etc/nginx/conf.d/irc.conf b/linux/nginx/etc/nginx/conf.d/irc.conf
index 56d54df..0ecbeae 100644
--- a/linux/nginx/etc/nginx/conf.d/irc.conf
+++ b/linux/nginx/etc/nginx/conf.d/irc.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name irc.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10027;
+	server_name irc.zerolabs.sh irc.cleberg.net;
+
+	if ($host = irc.cleberg.net) {
+	    return 301 https://irc.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -12,8 +12,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name irc.zerolabs.sh;
-    return 301 https://irc.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/ld.conf b/linux/nginx/etc/nginx/conf.d/ld.conf
index 8070bb6..f5d00c3 100644
--- a/linux/nginx/etc/nginx/conf.d/ld.conf
+++ b/linux/nginx/etc/nginx/conf.d/ld.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name ld.zerolabs.sh  u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion;
+	listen 10028;
+	server_name ld.zerolabs.sh u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion ld.cleberg.net;
+
+	if ($host = ld.cleberg.net) {
+	    return 301 https://ld.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name ld.zerolabs.sh;
-    return 301 https://ld.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name ld.cleberg.net;
-    return 301 https://ld.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name ld.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://ld.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/lt.conf b/linux/nginx/etc/nginx/conf.d/lt.conf
index 2ffa405..cd43ee2 100644
--- a/linux/nginx/etc/nginx/conf.d/lt.conf
+++ b/linux/nginx/etc/nginx/conf.d/lt.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name lt.zerolabs.sh  nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion;
+	listen 10029;
+	server_name lt.zerolabs.sh nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion lt.cleberg.net;
+
+	if ($host = lt.cleberg.net) {
+	    return 301 https://lt.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name lt.zerolabs.sh;
-    return 301 https://lt.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name lt.cleberg.net;
-    return 301 https://lt.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name lt.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://lt.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/mz.conf b/linux/nginx/etc/nginx/conf.d/mz.conf
index a1e4507..6babdfd 100644
--- a/linux/nginx/etc/nginx/conf.d/mz.conf
+++ b/linux/nginx/etc/nginx/conf.d/mz.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name mz.zerolabs.sh  ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion;
+	listen 10030;
+	server_name mz.zerolabs.sh ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion mz.cleberg.net;
+
+	if ($host = mz.cleberg.net) {
+	    return 301 https://mz.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name mz.zerolabs.sh;
-    return 301 https://mz.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name mz.cleberg.net;
-    return 301 https://mz.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name mz.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://mz.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/office.conf b/linux/nginx/etc/nginx/conf.d/office.conf
index 4991133..6d864aa 100644
--- a/linux/nginx/etc/nginx/conf.d/office.conf
+++ b/linux/nginx/etc/nginx/conf.d/office.conf
@@ -1,43 +1,22 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name office.zerolabs.sh;
+	listen 10031;
+	server_name office.zerolabs.sh office.cleberg.net;
+
+	if ($host = office.cleberg.net) {
+	    return 301 https://office.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion$request_uri" always;
 	root /var/www/office/;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
 server {
-    listen 127.0.0.1:8088;
+    listen 10032;
     server_name uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion;
     include custom.d/basic.conf;
     root /var/www/office/;
     location / { try_files $uri $uri/ /index.html; }
 }
 
-server {
-    listen 80;
-    server_name office.zerolabs.sh;
-    return 301 https://office.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name office.cleberg.net;
-    return 301 https://office.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name office.cleberg.net;
-
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://office.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/org.conf b/linux/nginx/etc/nginx/conf.d/org.conf
index ce8c96f..f93c19e 100644
--- a/linux/nginx/etc/nginx/conf.d/org.conf
+++ b/linux/nginx/etc/nginx/conf.d/org.conf
@@ -1,43 +1,22 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name org.zerolabs.sh;
+	listen 10033;
+	server_name org.zerolabs.sh org.cleberg.net;
+
+	if ($host = org.cleberg.net) {
+	    return 301 https://org.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion$request_uri" always;
 	root /var/www/org/;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
 server {
-    listen 127.0.0.1:8085;
+    listen 10034;
     server_name 7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion;
     include custom.d/basic.conf;
     root /var/www/org/;
     location / { try_files $uri $uri/ /index.html; }
 }
 
-server {
-    listen 80;
-    server_name org.zerolabs.sh;
-    return 301 https://org.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name org.cleberg.net;
-    return 301 https://org.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name org.cleberg.net;
-
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://org.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/paste.conf b/linux/nginx/etc/nginx/conf.d/paste.conf
index 8b8640d..3601a87 100644
--- a/linux/nginx/etc/nginx/conf.d/paste.conf
+++ b/linux/nginx/etc/nginx/conf.d/paste.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name paste.zerolabs.sh  ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion;
+	listen 10035;
+	server_name paste.zerolabs.sh ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion paste.cleberg.net;
+
+	if ($host = paste.cleberg.net) {
+	    return 301 https://paste.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name paste.zerolabs.sh;
-    return 301 https://paste.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name paste.cleberg.net;
-    return 301 https://paste.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name paste.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://paste.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/pb.conf b/linux/nginx/etc/nginx/conf.d/pb.conf
index 4687789..ef1b355 100644
--- a/linux/nginx/etc/nginx/conf.d/pb.conf
+++ b/linux/nginx/etc/nginx/conf.d/pb.conf
@@ -1,13 +1,13 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name pb.zerolabs.sh;
+	listen 10036;
+	server_name pb.zerolabs.sh pb.cleberg.net;
+
+	if ($host = pb.cleberg.net) {
+	    return 301 https://pb.zerolabs.sh$request_uri;
+	}
 
 	error_log /var/log/nginx/pb.log;
 
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -18,26 +18,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name pb.zerolabs.sh;
-    return 301 https://pb.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name pb.cleberg.net;
-    return 301 https://pb.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name pb.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://pb.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/photos.conf b/linux/nginx/etc/nginx/conf.d/photos.conf
index a7c90b4..f90a6b7 100644
--- a/linux/nginx/etc/nginx/conf.d/photos.conf
+++ b/linux/nginx/etc/nginx/conf.d/photos.conf
@@ -1,10 +1,6 @@
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10037;
 	server_name photos.cleberg.net;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	client_max_body_size 50000M;
 	proxy_set_header Host              $host;
@@ -21,8 +17,3 @@ server {
 	location / { proxy_pass $backend_address; }
 }
 
-server {
-    listen 80;
-    server_name photos.cleberg.net;
-    return 301 https://photos.cleberg.net$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/pin.conf b/linux/nginx/etc/nginx/conf.d/pin.conf
index 7f91436..b0b036f 100644
--- a/linux/nginx/etc/nginx/conf.d/pin.conf
+++ b/linux/nginx/etc/nginx/conf.d/pin.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name pin.zerolabs.sh  3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion;
+	listen 10038;
+	server_name pin.zerolabs.sh 3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion pin.cleberg.net;
+
+	if ($host = pin.cleberg.net) {
+	    return 301 https://pin.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name pin.zerolabs.sh;
-    return 301 https://pin.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name pin.cleberg.net;
-    return 301 https://pin.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name pin.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://pin.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/piped.conf b/linux/nginx/etc/nginx/conf.d/piped.conf
index 4961144..b971e4a 100644
--- a/linux/nginx/etc/nginx/conf.d/piped.conf
+++ b/linux/nginx/etc/nginx/conf.d/piped.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name piped.zerolabs.sh pipedapi.zerolabs.sh pipedproxy.zerolabs.sh  5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion;
+	listen 10039;
+	server_name piped.zerolabs.sh pipedapi.zerolabs.sh pipedproxy.zerolabs.sh 5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion piped.cleberg.net;
+
+	if ($host = piped.cleberg.net) {
+	    return 301 https://piped.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name pipedapi.zerolabs.sh;
-    return 301 https://pipedapi.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net;
-    return 301 https://pipedapi.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://pipedapi.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/projects.conf b/linux/nginx/etc/nginx/conf.d/projects.conf
index 3272536..f537af2 100644
--- a/linux/nginx/etc/nginx/conf.d/projects.conf
+++ b/linux/nginx/etc/nginx/conf.d/projects.conf
@@ -1,19 +1,19 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name projects.zerolabs.sh;
+	listen 10040;
+	server_name projects.zerolabs.sh projects.cleberg.net;
+
+	if ($host = projects.cleberg.net) {
+	    return 301 https://projects.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion$request_uri" always;
 	root /var/www/projects/;
 	autoindex on;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
 
 server {
-    listen 127.0.0.1:8089;
+    listen 10041;
     server_name krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion;
     include custom.d/basic.conf;
     root /var/www/projects/;
@@ -21,26 +21,5 @@ server {
     location / { try_files $uri $uri/ /index.html; }
 }
 
-server {
-    listen 80;
-    server_name projects.zerolabs.sh;
-    return 301 https://projects.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 80;
-    server_name projects.cleberg.net;
-    return 301 https://projects.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name projects.cleberg.net;
-
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://projects.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/rd.conf b/linux/nginx/etc/nginx/conf.d/rd.conf
index 778e5e9..ed59ce0 100644
--- a/linux/nginx/etc/nginx/conf.d/rd.conf
+++ b/linux/nginx/etc/nginx/conf.d/rd.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name rd.zerolabs.sh  voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion;
+	listen 10042;
+	server_name rd.zerolabs.sh voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion rd.cleberg.net;
+
+	if ($host = rd.cleberg.net) {
+	    return 301 https://rd.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name rd.zerolabs.sh;
-    return 301 https://rd.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name rd.cleberg.net;
-    return 301 https://rd.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name rd.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://rd.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
index 0336884..86a8571 100644
--- a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
+++ b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
@@ -1,28 +1,10 @@
-server {
-	listen 443 ssl;
-	http2 on;
-	server_name www.reminiscecleberg.com;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_strict.conf;
-	include custom.d/tls/certificate_files_reminiscecleberg_com.conf;
-	return 301 $scheme://reminiscecleberg.com$request_uri;
-}
 
 
 server {
-	listen 443 ssl;
-	http2 on;
+	listen 10043;
 	server_name reminiscecleberg.com;
 	root /var/www/reminiscecleberg.com/;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_strict.conf;
-	include custom.d/tls/certificate_files_reminiscecleberg_com.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ =404; }
 }
 
-server {
-	listen 80;
-	server_name www.reminiscecleberg.com reminiscecleberg.com;
-	return 301 https://reminiscecleberg.com$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/rl.conf b/linux/nginx/etc/nginx/conf.d/rl.conf
index afabd63..6c356b3 100644
--- a/linux/nginx/etc/nginx/conf.d/rl.conf
+++ b/linux/nginx/etc/nginx/conf.d/rl.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name rl.zerolabs.sh  s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion;
+	listen 10044;
+	server_name rl.zerolabs.sh s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion rl.cleberg.net;
+
+	if ($host = rl.cleberg.net) {
+	    return 301 https://rl.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -16,26 +16,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name rl.zerolabs.sh;
-    return 301 https://rl.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name rl.cleberg.net;
-    return 301 https://rl.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name rl.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://rl.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/rss.conf b/linux/nginx/etc/nginx/conf.d/rss.conf
index 3eccab2..ed97427 100644
--- a/linux/nginx/etc/nginx/conf.d/rss.conf
+++ b/linux/nginx/etc/nginx/conf.d/rss.conf
@@ -1,11 +1,11 @@
 upstream freshrss { server 127.0.0.1:8099; keepalive 64; }
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name rss.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10045;
+	server_name rss.zerolabs.sh rss.cleberg.net;
+
+	if ($host = rss.cleberg.net) {
+	    return 301 https://rss.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass http://freshrss/;
@@ -24,8 +24,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name rss.zerolabs.sh;
-    return 301 https://rss.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/search.conf b/linux/nginx/etc/nginx/conf.d/search.conf
index 00197ee..87ec28f 100644
--- a/linux/nginx/etc/nginx/conf.d/search.conf
+++ b/linux/nginx/etc/nginx/conf.d/search.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name search.zerolabs.sh  txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion;
+	listen 10046;
+	server_name search.zerolabs.sh txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion search.cleberg.net;
+
+	if ($host = search.cleberg.net) {
+	    return 301 https://search.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -18,26 +18,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name search.zerolabs.sh;
-    return 301 https://search.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name search.cleberg.net;
-    return 301 https://search.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name search.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://search.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/send.conf b/linux/nginx/etc/nginx/conf.d/send.conf
index 8db77db..30c714f 100644
--- a/linux/nginx/etc/nginx/conf.d/send.conf
+++ b/linux/nginx/etc/nginx/conf.d/send.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name send.zerolabs.sh 6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion;
+	listen 10047;
+	server_name send.zerolabs.sh 6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion send.cleberg.net;
+
+	if ($host = send.cleberg.net) {
+	    return 301 https://send.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name send.zerolabs.sh;
-    return 301 https://send.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name send.cleberg.net;
-    return 301 https://send.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name send.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://send.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/slash.conf b/linux/nginx/etc/nginx/conf.d/slash.conf
index e613944..f593657 100644
--- a/linux/nginx/etc/nginx/conf.d/slash.conf
+++ b/linux/nginx/etc/nginx/conf.d/slash.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name slash.zerolabs.sh svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion;
+	listen 10048;
+	server_name slash.zerolabs.sh svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion slash.cleberg.net;
+
+	if ($host = slash.cleberg.net) {
+	    return 301 https://slash.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name slash.zerolabs.sh;
-    return 301 https://slash.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name slash.cleberg.net;
-    return 301 https://slash.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name slash.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://slash.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/small.conf b/linux/nginx/etc/nginx/conf.d/small.conf
index 73a61d3..b8f969f 100644
--- a/linux/nginx/etc/nginx/conf.d/small.conf
+++ b/linux/nginx/etc/nginx/conf.d/small.conf
@@ -1,11 +1,11 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name small.zerolabs.sh  w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion;
+	listen 10049;
+	server_name small.zerolabs.sh w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion small.cleberg.net;
+
+	if ($host = small.cleberg.net) {
+	    return 301 https://small.zerolabs.sh$request_uri;
+	}
 	add_header Onion-Location "http://w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion$request_uri" always;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass $backend_address;
@@ -14,26 +14,5 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name small.zerolabs.sh;
-    return 301 https://small.zerolabs.sh$request_uri;
-}
-
-server {
-    listen 80;
-    server_name small.cleberg.net;
-    return 301 https://small.zerolabs.sh$request_uri;
-}
 
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name small.cleberg.net;
 
-    include custom.d/tls/ssl_engine.conf;
-    include custom.d/tls/certificate_files_cleberg_net.conf;
-    include custom.d/tls/policy_strict.conf;
-
-    return 301 https://small.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/ssh.conf b/linux/nginx/etc/nginx/conf.d/ssh.conf
index 2c25cdf..2d55839 100644
--- a/linux/nginx/etc/nginx/conf.d/ssh.conf
+++ b/linux/nginx/etc/nginx/conf.d/ssh.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name ssh.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10050;
+	server_name ssh.zerolabs.sh ssh.cleberg.net;
+
+	if ($host = ssh.cleberg.net) {
+	    return 301 https://ssh.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -15,8 +15,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name ssh.zerolabs.sh;
-    return 301 https://ssh.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/zb.conf b/linux/nginx/etc/nginx/conf.d/zb.conf
index 7ef056e..3022530 100644
--- a/linux/nginx/etc/nginx/conf.d/zb.conf
+++ b/linux/nginx/etc/nginx/conf.d/zb.conf
@@ -1,10 +1,10 @@
 server {
-	listen 443 ssl;
-	http2 on;
-	server_name zb.zerolabs.sh;
-	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/certificate_files_cleberg_net.conf;
-	include custom.d/tls/policy_strict.conf;
+	listen 10051;
+	server_name zb.zerolabs.sh zb.cleberg.net;
+
+	if ($host = zb.cleberg.net) {
+	    return 301 https://zb.zerolabs.sh$request_uri;
+	}
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
@@ -15,8 +15,3 @@ server {
 	include custom.d/security/robots_index_only.conf;
 }
 
-server {
-    listen 80;
-    server_name zb.zerolabs.sh;
-    return 301 https://zb.zerolabs.sh$request_uri;
-}
diff --git a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
index c68c0aa..44af9d2 100644
--- a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
+++ b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
@@ -1,8 +1,3 @@
-server {
-        listen 10000;
-        server_name www.zerolabs.sh;
-        return 301 $scheme://zerolabs.sh$request_uri;
-}
 
 server {
         listen 10000;