From 565e8c2db8e79197ffb49554a70e209fa1ead16e Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Mon, 3 Aug 2026 00:31:22 -0500
Subject: chore: cleanup

---
 linux/nginx/etc/nginx/conf.d/cleberg.dev.conf      |  2 +-
 linux/nginx/etc/nginx/conf.d/cleberg.io.conf       |  1 -
 linux/nginx/etc/nginx/conf.d/cleberg.net.conf      | 22 +++-------
 .../etc/nginx/conf.d/cleberg.net_wildcard.conf     |  1 -
 linux/nginx/etc/nginx/conf.d/cv.conf               |  4 +-
 linux/nginx/etc/nginx/conf.d/files.conf            | 10 +++--
 linux/nginx/etc/nginx/conf.d/git.conf              | 17 +++++---
 linux/nginx/etc/nginx/conf.d/hn.conf               |  9 ++--
 linux/nginx/etc/nginx/conf.d/img.conf              |  4 +-
 linux/nginx/etc/nginx/conf.d/krz.sh.conf           |  2 +-
 linux/nginx/etc/nginx/conf.d/office.conf           |  9 ++--
 linux/nginx/etc/nginx/conf.d/org.conf              |  9 ++--
 linux/nginx/etc/nginx/conf.d/projects.conf         |  9 ++--
 .../etc/nginx/conf.d/reminiscecleberg.com.conf     |  2 +-
 linux/nginx/etc/nginx/conf.d/rogue.conf            |  2 +-
 linux/nginx/etc/nginx/conf.d/rss.conf              |  7 +--
 linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf      |  7 ++-
 linux/nginx/etc/nginx/custom.d/basic.conf          |  8 ++++
 .../etc/nginx/custom.d/tls/certificate_files.conf  |  2 -
 .../tls/certificate_files_cleberg_dev.conf         |  3 --
 .../custom.d/tls/certificate_files_cleberg_io.conf |  3 --
 .../tls/certificate_files_cleberg_net.conf         | 16 -------
 .../certificate_files_reminiscecleberg_com.conf    |  3 --
 .../tls/certificate_files_zerolabs_sh.conf         |  3 --
 .../etc/nginx/custom.d/tls/ocsp_stapling.conf      | 34 ---------------
 .../etc/nginx/custom.d/tls/policy_balanced.conf    | 20 ---------
 .../etc/nginx/custom.d/tls/policy_strict.conf      | 50 ----------------------
 linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf | 47 --------------------
 28 files changed, 62 insertions(+), 244 deletions(-)
 delete mode 100644 linux/nginx/etc/nginx/conf.d/cleberg.io.conf
 delete mode 100644 linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf
 delete mode 100644 linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf

(limited to 'linux/nginx/etc')

diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
index 088c9ff..69282e0 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf
@@ -1,7 +1,7 @@
 
 
 server {
-        listen 10010;
+        listen 127.0.0.1:10010;
         server_name cleberg.dev;
         root /var/www/cleberg.dev/;
         include custom.d/basic.conf;
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
deleted file mode 100644
index 8b13789..0000000
--- a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
index e01276f..6030fd0 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
@@ -1,11 +1,14 @@
 server {
-	listen 10011;
+	listen 127.0.0.1:10011;
 	server_name cleberg.net paske4urhs6nttrtlkuwa5cowum3fjkc6yv6kl4ncx3mjxcd77764nqd.onion;
-	error_log /var/log/nginx/cleberg.net.error.log;
+
+	# No per-vhost error_log: it overrode the global "off" and wrote visitor
+	# IPs to disk.
+
+	# basic.conf now carries HSTS + Permissions-Policy. CSP stays explicit --
+	# the shared policy is written for this vhost (it allows img.cleberg.net).
 	include custom.d/basic.conf;
-	include custom.d/security/strict-transport-security.conf;
 	include custom.d/security/content-security-policy.conf;
-	include custom.d/security/permissions-policy.conf;
 	root /var/www/cleberg.net/;
 	include custom.d/redirects/blog.conf;
 	port_in_redirect off;
@@ -48,14 +51,3 @@ server {
 		try_files $uri =404;
 	}
 }
-
-server {
-	listen 10012;
-	server_name hutch.cleberg.net;
-	include custom.d/basic.conf;
-	include custom.d/security/strict-transport-security.conf;
-	include custom.d/security/content-security-policy.conf;
-	include custom.d/security/permissions-policy.conf;
-	location = /privacy.html { return 301 https://zerolabs.sh/hutch/privacy-policy/; }
-	location = / { return 301 https://zerolabs.sh/hutch/; }
-}
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
deleted file mode 100644
index 8b13789..0000000
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/linux/nginx/etc/nginx/conf.d/cv.conf b/linux/nginx/etc/nginx/conf.d/cv.conf
index 5cbece2..3dc73a2 100644
--- a/linux/nginx/etc/nginx/conf.d/cv.conf
+++ b/linux/nginx/etc/nginx/conf.d/cv.conf
@@ -1,5 +1,5 @@
 server {
-	listen 10014;
+	listen 127.0.0.1:10014;
 	server_name cv.cleberg.net;
 	add_header Onion-Location "http://xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion$request_uri" always;
 	include custom.d/basic.conf;
@@ -9,7 +9,7 @@ server {
 }
 
 server {
-    listen 10015;
+    listen 127.0.0.1:10015;
     server_name xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion;
     include custom.d/basic.conf;
     root /var/www/cv/;
diff --git a/linux/nginx/etc/nginx/conf.d/files.conf b/linux/nginx/etc/nginx/conf.d/files.conf
index 7fc7247..684e895 100644
--- a/linux/nginx/etc/nginx/conf.d/files.conf
+++ b/linux/nginx/etc/nginx/conf.d/files.conf
@@ -1,6 +1,10 @@
 server {
-	listen 10017;
-	server_name files.cleberg.net;
+	listen 127.0.0.1:10017;
+	# files.cleberg.net was retired 2026-08-03: it and files.krz.sh both routed
+	# here, so one origin served byte-identical content under both identities.
+	# The real-name hostname was removed; this vhost is krz-only now. Named
+	# explicitly rather than left to default-server fallback.
+	server_name files.krz.sh;
 	add_header Onion-Location "http://yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion$request_uri" always;
 	include custom.d/basic.conf;
 	root /var/www/files/;
@@ -9,7 +13,7 @@ server {
 }
 
 server {
-    listen 10018;
+    listen 127.0.0.1:10018;
     server_name yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion;
     include custom.d/basic.conf;
     root /var/www/files/;
diff --git a/linux/nginx/etc/nginx/conf.d/git.conf b/linux/nginx/etc/nginx/conf.d/git.conf
index 884000c..a3690d1 100644
--- a/linux/nginx/etc/nginx/conf.d/git.conf
+++ b/linux/nginx/etc/nginx/conf.d/git.conf
@@ -3,13 +3,14 @@
 # Repos are scanned from /git (scan-path in /etc/cgitrc).
 
 server {
-	listen 10046;
+	listen 127.0.0.1:10046;
 	server_name git.krz.sh;
-	error_log /var/log/nginx/git.krz.sh.error.log;
 
+	# No per-vhost error_log: it overrode the global "off" and wrote visitor
+	# IPs to disk for the pseudonymous vhost.
+
+	# basic.conf now carries HSTS + Permissions-Policy.
 	include custom.d/basic.conf;
-	include custom.d/security/strict-transport-security.conf;
-	include custom.d/security/permissions-policy.conf;
 
 	# The shared CSP (default-src 'self', no style-src) breaks cgit: the
 	# pygments source-filter writes an inline <style> block into every blob
@@ -51,8 +52,14 @@ server {
 		fastcgi_pass unix:/run/fcgiwrap.socket;
 		fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
 		fastcgi_param GIT_PROJECT_ROOT /git;
-		fastcgi_param GIT_HTTP_EXPORT_ALL 1;
 		fastcgi_param PATH_INFO $uri;
+
+		# GIT_HTTP_EXPORT_ALL is deliberately absent. git-http-backend tests
+		# it with getenv(), so ANY value -- including "0" -- exports every
+		# repo under GIT_PROJECT_ROOT. The variable must simply not be set.
+		# Export is now opt-in per repo via a git-daemon-export-ok marker,
+		# so a repo dropped into /git is not published by accident.
+
 		fastcgi_param QUERY_STRING $args;
 
 		# /git is owned by uid 1001, which maps to no account on this host,
diff --git a/linux/nginx/etc/nginx/conf.d/hn.conf b/linux/nginx/etc/nginx/conf.d/hn.conf
index f993a69..4b2cab2 100644
--- a/linux/nginx/etc/nginx/conf.d/hn.conf
+++ b/linux/nginx/etc/nginx/conf.d/hn.conf
@@ -1,11 +1,8 @@
 server {
-    listen 10023;
-    listen 10024;
-    server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion hn.cleberg.net;
+    listen 127.0.0.1:10023;
+    listen 127.0.0.1:10024;
+    server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion;
 
-    if ($host = hn.cleberg.net) {
-        return 301 https://hn.zerolabs.sh$request_uri;
-    }
     root /var/www/hn/output/;
     autoindex on;
     add_header Onion-Location "http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion$request_uri" always;
diff --git a/linux/nginx/etc/nginx/conf.d/img.conf b/linux/nginx/etc/nginx/conf.d/img.conf
index 3b13c8a..16c9ab0 100644
--- a/linux/nginx/etc/nginx/conf.d/img.conf
+++ b/linux/nginx/etc/nginx/conf.d/img.conf
@@ -1,5 +1,5 @@
 server {
-	listen 10025;
+	listen 127.0.0.1:10025;
 	server_name img.cleberg.net;
 	add_header Onion-Location "http://ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion$request_uri" always;
 	include custom.d/basic.conf;
@@ -9,7 +9,7 @@ server {
 }
 
 server {
-    listen 10026;
+    listen 127.0.0.1:10026;
     server_name ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion;
     include custom.d/basic.conf;
     root /var/www/img/;
diff --git a/linux/nginx/etc/nginx/conf.d/krz.sh.conf b/linux/nginx/etc/nginx/conf.d/krz.sh.conf
index eaf9900..0169dbe 100644
--- a/linux/nginx/etc/nginx/conf.d/krz.sh.conf
+++ b/linux/nginx/etc/nginx/conf.d/krz.sh.conf
@@ -1,5 +1,5 @@
 server {
-	listen 10047;
+	listen 127.0.0.1:10047;
 	server_name krz.sh;
 	root /var/www/krz.sh/;
 	absolute_redirect off;
diff --git a/linux/nginx/etc/nginx/conf.d/office.conf b/linux/nginx/etc/nginx/conf.d/office.conf
index 6d864aa..74c7032 100644
--- a/linux/nginx/etc/nginx/conf.d/office.conf
+++ b/linux/nginx/etc/nginx/conf.d/office.conf
@@ -1,17 +1,14 @@
 server {
-	listen 10031;
-	server_name office.zerolabs.sh office.cleberg.net;
+	listen 127.0.0.1:10031;
+	server_name office.zerolabs.sh;
 
-	if ($host = office.cleberg.net) {
-	    return 301 https://office.zerolabs.sh$request_uri;
-	}
 	add_header Onion-Location "http://uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion$request_uri" always;
 	root /var/www/office/;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
 server {
-    listen 10032;
+    listen 127.0.0.1:10032;
     server_name uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion;
     include custom.d/basic.conf;
     root /var/www/office/;
diff --git a/linux/nginx/etc/nginx/conf.d/org.conf b/linux/nginx/etc/nginx/conf.d/org.conf
index f93c19e..fbf84a0 100644
--- a/linux/nginx/etc/nginx/conf.d/org.conf
+++ b/linux/nginx/etc/nginx/conf.d/org.conf
@@ -1,17 +1,14 @@
 server {
-	listen 10033;
-	server_name org.zerolabs.sh org.cleberg.net;
+	listen 127.0.0.1:10033;
+	server_name org.zerolabs.sh;
 
-	if ($host = org.cleberg.net) {
-	    return 301 https://org.zerolabs.sh$request_uri;
-	}
 	add_header Onion-Location "http://7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion$request_uri" always;
 	root /var/www/org/;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
 server {
-    listen 10034;
+    listen 127.0.0.1:10034;
     server_name 7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion;
     include custom.d/basic.conf;
     root /var/www/org/;
diff --git a/linux/nginx/etc/nginx/conf.d/projects.conf b/linux/nginx/etc/nginx/conf.d/projects.conf
index f537af2..bcdfae9 100644
--- a/linux/nginx/etc/nginx/conf.d/projects.conf
+++ b/linux/nginx/etc/nginx/conf.d/projects.conf
@@ -1,10 +1,7 @@
 server {
-	listen 10040;
-	server_name projects.zerolabs.sh projects.cleberg.net;
+	listen 127.0.0.1:10040;
+	server_name projects.zerolabs.sh;
 
-	if ($host = projects.cleberg.net) {
-	    return 301 https://projects.zerolabs.sh$request_uri;
-	}
 	add_header Onion-Location "http://krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion$request_uri" always;
 	root /var/www/projects/;
 	autoindex on;
@@ -13,7 +10,7 @@ server {
 }
 
 server {
-    listen 10041;
+    listen 127.0.0.1:10041;
     server_name krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion;
     include custom.d/basic.conf;
     root /var/www/projects/;
diff --git a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
index 86a8571..02b1721 100644
--- a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
+++ b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
@@ -1,7 +1,7 @@
 
 
 server {
-	listen 10043;
+	listen 127.0.0.1:10043;
 	server_name reminiscecleberg.com;
 	root /var/www/reminiscecleberg.com/;
 	include custom.d/basic.conf;
diff --git a/linux/nginx/etc/nginx/conf.d/rogue.conf b/linux/nginx/etc/nginx/conf.d/rogue.conf
index 03e0b98..1618be3 100644
--- a/linux/nginx/etc/nginx/conf.d/rogue.conf
+++ b/linux/nginx/etc/nginx/conf.d/rogue.conf
@@ -1,5 +1,5 @@
 server {
-    listen 10001;
+    listen 127.0.0.1:10001;
     server_name rogue.krz.sh;
 
     root /var/www/rogue;
diff --git a/linux/nginx/etc/nginx/conf.d/rss.conf b/linux/nginx/etc/nginx/conf.d/rss.conf
index ed97427..44bde88 100644
--- a/linux/nginx/etc/nginx/conf.d/rss.conf
+++ b/linux/nginx/etc/nginx/conf.d/rss.conf
@@ -1,11 +1,8 @@
 upstream freshrss { server 127.0.0.1:8099; keepalive 64; }
 server {
-	listen 10045;
-	server_name rss.zerolabs.sh rss.cleberg.net;
+	listen 127.0.0.1:10045;
+	server_name rss.zerolabs.sh;
 
-	if ($host = rss.cleberg.net) {
-	    return 301 https://rss.zerolabs.sh$request_uri;
-	}
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass http://freshrss/;
diff --git a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
index afdc3e3..0f5e5be 100644
--- a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
+++ b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf
@@ -5,8 +5,13 @@ map $host $krz_target {
 }
 
 server {
-    listen      10000;
+    listen      127.0.0.1:10000;
     server_name zerolabs.sh *.zerolabs.sh;
 
+    # This vhost is a bare redirect and does not include basic.conf, so HSTS
+    # is set explicitly -- otherwise the redirect hop is the one response on
+    # this domain without it.
+    include custom.d/security/strict-transport-security.conf;
+
     return 301 https://$krz_target$request_uri;
 }
diff --git a/linux/nginx/etc/nginx/custom.d/basic.conf b/linux/nginx/etc/nginx/custom.d/basic.conf
index 8de788c..3c6cfce 100644
--- a/linux/nginx/etc/nginx/custom.d/basic.conf
+++ b/linux/nginx/etc/nginx/custom.d/basic.conf
@@ -4,5 +4,13 @@
 include custom.d/security/referrer-policy.conf;
 include custom.d/security/x-content-type-options.conf;
 include custom.d/security/x-frame-options.conf;
+include custom.d/security/strict-transport-security.conf;
+include custom.d/security/permissions-policy.conf;
 include custom.d/location/security_file_access.conf;
 #include custom.d/cross-origin/requests.conf;
+
+# HSTS and Permissions-Policy live here, not per-vhost: every vhost is HTTPS
+# via the tunnel, so the commitment is universal. CSP is deliberately NOT
+# here -- it is content-type-mapped and a blanket policy breaks app UIs, so
+# it stays per-vhost until the per-app pass. Note that rogue.conf does not
+# include this file (intentional: it strips headers as a byte-size test).
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
deleted file mode 100644
index 7726591..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-# Legacy include name: cleberg.net certificate (most zerolabs/cleberg.net vhosts).
-include certificate_files_cleberg_net.conf;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf
deleted file mode 100644
index d74f2c8..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-ssl_certificate         /etc/letsencrypt/live/cleberg.dev/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/cleberg.dev/privkey.pem;
-ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf
deleted file mode 100644
index a94c829..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-ssl_certificate         /etc/letsencrypt/live/cleberg.io/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/cleberg.io/privkey.pem;
-ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf
deleted file mode 100644
index afd7aa9..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-# ----------------------------------------------------------------------
-# | Certificate files — cleberg.net                                    |
-# ----------------------------------------------------------------------
-
-# This default SSL certificate will be served whenever the client lacks support
-# for SNI (Server Name Indication).
-#
-# (1) Certificate and key files location
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
-#
-# (2) Intermediate certificate for OCSP stapling
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate
-
-ssl_certificate         /etc/letsencrypt/live/cleberg.net/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/cleberg.net/privkey.pem;
-ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf
deleted file mode 100644
index 00f9ef7..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
-ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf
deleted file mode 100644
index 3a6ba1a..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-ssl_certificate         /etc/letsencrypt/live/zerolabs.sh/fullchain.pem;
-ssl_certificate_key     /etc/letsencrypt/live/zerolabs.sh/privkey.pem;
-ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf b/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf
deleted file mode 100644
index 4a16fbc..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf
+++ /dev/null
@@ -1,34 +0,0 @@
-# ----------------------------------------------------------------------
-# | Online Certificate Status Protocol stapling                        |
-# ----------------------------------------------------------------------
-
-# OCSP is a lightweight, only one record to help clients verify the validity of
-# the server certificate.
-# OCSP stapling allows the server to send its cached OCSP record during the TLS
-# handshake, without the need of 3rd party OCSP responder.
-#
-# https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling
-# https://tools.ietf.org/html/rfc6066#section-8
-# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
-#
-# (1) Use Cloudflare 1.1.1.1 DNS resolver
-#     https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/
-#
-# (2) Use Google 8.8.8.8 DNS resolver
-#     https://developers.google.com/speed/public-dns/docs/using
-#
-# (3) Use OpenDNS resolver
-#     https://use.opendns.com
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-resolver
-  # (1)
-  1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
-  # (2)
-  8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844]
-  # (3)
-  # 208.67.222.222 208.67.220.220 [2620:119:35::35] [2620:119:53::53]
-  valid=60s;
-resolver_timeout 2s;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf b/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf
deleted file mode 100644
index f8a19c9..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf
+++ /dev/null
@@ -1,20 +0,0 @@
-# ----------------------------------------------------------------------
-# | SSL policy - Balanced                                              |
-# ----------------------------------------------------------------------
-
-# For services that need to support a wide range of clients, this configuration
-# is reasonably balanced.
-#
-# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak
-#     and potentially vulnerable but are required to support Microsoft Edge
-#     and Safari.
-#     https://safecurves.cr.yp.to/
-#
-# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
-# https://nginx.org/en/docs/http/ngx_http_ssl_module.html
-
-ssl_protocols TLSv1.2;
-ssl_ciphers EECDH+CHACHA20:EECDH+AES;
-
-# (1)
-ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf b/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf
deleted file mode 100644
index 8d0a70b..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf
+++ /dev/null
@@ -1,50 +0,0 @@
-# ----------------------------------------------------------------------
-# | SSL policy - Strict                                                |
-# ----------------------------------------------------------------------
-
-# For services that don't need backward compatibility, the parameters below
-# provide the highest level of security and performance.
-#
-# (!) This policy enforces a strong TLS configuration, which may raise
-#     errors with old clients.
-#     If a more compatible profile is required, use the "balanced" policy.
-#
-# (!) TLSv1.3 and its 0-RTT feature require NGINX >=1.15.4 and OpenSSL >=1.1.1
-#     to be installed.
-#
-# (!) Don't enable `ssl_early_data` blindly! Requests sent within early data are
-#     subject to replay attacks.
-#
-# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak
-#     and potentially vulnerable.
-#
-#     Add them back to the parameter `ssl_ecdh_curve` below to support
-#     Microsoft Edge and Safari.
-#
-#     https://safecurves.cr.yp.to/
-#
-# (2) Enables TLS 1.3 0-RTT, allows for faster resumption of TLS sessions.
-#
-# (!) Requests sent within early data are subject to replay attacks.
-#     To protect against such attacks at the application layer, the
-#     `$ssl_early_data` variable should be used:
-#
-#         proxy_set_header Early-Data $ssl_early_data;
-#
-#     The application should return response code 425 "Too Early" for anything
-#     that could contain user supplied data.
-#
-#     https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/425
-#
-# https://github.com/certbot/certbot/issues/6367
-# https://github.com/mozilla/server-side-tls/issues/217
-# https://nginx.org/en/docs/http/ngx_http_ssl_module.html
-
-ssl_protocols TLSv1.2 TLSv1.3;
-ssl_ciphers EECDH+CHACHA20:EECDH+AES;
-
-# (1)
-ssl_ecdh_curve X25519;
-
-# (2)
-#ssl_early_data on;
diff --git a/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf b/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf
deleted file mode 100644
index 4c3b33a..0000000
--- a/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf
+++ /dev/null
@@ -1,47 +0,0 @@
-# ----------------------------------------------------------------------
-# | SSL engine                                                         |
-# ----------------------------------------------------------------------
-
-# (1) Optimize SSL by caching session parameters for 24 hours.
-#     This cuts down on the number of expensive SSL handshakes.
-#     By enabling a cache, we tell the client to re-use the already
-#     negotiated state.
-#     Here 10m (10 MB) in ssl_session_cache is size value (not time).
-#     1 MB cache can store about 4000 sessions, so we can store 40000 sessions.
-#
-# (2) Use a higher keepalive timeout to reduce the need for repeated handshakes
-#     (!) Shouldn't be done unless you serve primarily HTTPS.
-#     Default is 75s
-#
-# (3) SSL buffer size
-#     Set 1400 bytes to fit in one MTU.
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
-#
-# (4) Disable session tickets
-#     Session tickets keys are not auto-rotated. Only a HUP / restart will do
-#     so and when a restart is performed the previous key is lost, which resets
-#     all previous sessions.
-#     Only enable session tickets if you set up a manual rotation mechanism.
-#     https://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
-#
-# (5) The TLS 1.2 and 1.3 ciphers in use in current policies are not considered
-#     dangerous. This directive let the client choose the one that best fits their needs.
-#     https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
-#     https://wiki.mozilla.org/Security/Server_Side_TLS
-
-# (1)
-ssl_session_timeout 24h;
-ssl_session_cache shared:SSL:10m;
-
-# (2)
-keepalive_timeout 300s;
-
-# (3)
-# ssl_buffer_size 1400;
-
-# (4)
-ssl_session_tickets off;
-
-# (5)
-ssl_prefer_server_ciphers off;
-- 
cgit v1.2.3