- Unknown hostnames and direct IP access no longer land on the first
vhost (Gitea): port 80 closes the connection, except for ACME
challenges, and port 443 refuses the handshake.
- Mozilla intermediate ciphers (forward secrecy only, no CBC), session
cache, no session tickets, and HSTS with a short max-age for now.
- Set X-Forwarded-For to the client address instead of appending to
whatever the client sent.
One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.
Admin