- Unknown hostnames and direct IP access no longer land on the first
vhost (Gitea): port 80 closes the connection, except for ACME
challenges, and port 443 refuses the handshake.
- Mozilla intermediate ciphers (forward secrecy only, no CBC), session
cache, no session tickets, and HSTS with a short max-age for now.
- Set X-Forwarded-For to the client address instead of appending to
whatever the client sent.
