structuredAttrs is enabled
[context]	INFO	Can't find variable 'user'
[context]	INFO	Can't find variable 'email'

==================== Results ===================

>> Problem: [add_header_redefinition] Nested "add_header" drops parent headers.
Description: "add_header" replaces ALL parent headers. See documentation: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
Reason: Parent headers "x-frame-options", "x-content-type-options" was dropped in current level
Pseudo config:

server {
	server_name rad.mulatta.io;

	location / {
		add_header Cache-Control public, max-age=3600;
	}
	add_header X-Frame-Options DENY always;
	add_header X-Content-Type-Options nosniff always;
	add_header Referrer-Policy strict-origin-when-cross-origin always;
}

==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 1
    High: 0

\n\nThis can be caused by combining multiple incompatible services on the same hostname.\n\nFull merged config:\n\n
pid /run/nginx/nginx.pid;
error_log stderr;
daemon off;
events {
}
http {
    # Load mime types and configure maximum size of the types hash tables.
    include /nix/store/bqb4ja5w47g587b5j2hkl4993sw5mykd-mailcap-2.1.54/etc/nginx/mime.types;
    types_hash_max_size 2688;
    include /nix/store/ixc951srcxa7p68hpbnzzdimqi4ivlvk-nginx-1.30.4/conf/fastcgi.conf;
    include /nix/store/ixc951srcxa7p68hpbnzzdimqi4ivlvk-nginx-1.30.4/conf/uwsgi_params;
    default_type application/octet-stream;
    resolver [fd28:387a:8e:7600::1] 1.1.1.1 8.8.8.8;
    # optimisation
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound
    ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384";
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135
    ssl_session_tickets off;
    # We don't enable insecure ciphers by default, so this allows
    # clients to pick the most performant, per https://github.com/mozilla/server-side-tls/issues/260
    ssl_prefer_server_ciphers off;
    brotli on;
    brotli_static on;
    brotli_comp_level 5;
    brotli_window 512k;
    brotli_min_length 256;
    brotli_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/vnd.ms-fontobject application/wasm application/x-rss+xml application/x-web-app-manifest+json application/xhtml+xml application/xliff+xml application/xml font/collection font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon text/cache-manifest text/calendar text/css text/csv text/javascript text/markdown text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/xml;
    gzip on;
    gzip_static on;
    gzip_vary on;
    gzip_comp_level 5;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/vnd.ms-fontobject application/wasm application/x-rss+xml application/x-web-app-manifest+json application/xhtml+xml application/xliff+xml application/xml font/collection font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon text/cache-manifest text/calendar text/css text/csv text/javascript text/markdown text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/xml;
    proxy_redirect off;
    proxy_connect_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_read_timeout 3600s;
    proxy_http_version 1.1;
    # don't let clients close the keep-alive connection to upstream. See the nginx blog for details:
    # https://www.nginx.com/blog/avoiding-top-10-nginx-configuration-mistakes/#no-keepalives
    proxy_set_header "Connection" "";
    include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
    # $connection_upgrade is used for websocket proxying
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
    client_max_body_size 10m;
    server_tokens off;
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
    access_log syslog:server=unix:/dev/log;
    server {
        listen [::1]:443 quic default_server;
        listen [::1]:443 ssl default_server;
        listen 10.208.0.9:80 default_server;
        listen 10.208.0.9:443 quic default_server;
        listen 10.208.0.9:443 ssl default_server;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80 default_server;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic default_server;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl default_server;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80 default_server;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic default_server;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl default_server;
        listen 0.0.0.0:80 default_server;
        listen 0.0.0.0:443 quic default_server;
        listen 0.0.0.0:443 ssl default_server;
        server_name _;
        ssl_reject_handshake on;
        location / {
            return 444;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name atuin.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name atuin.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8888;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name blossom.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name blossom.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8396;
            client_max_body_size 100m;
            proxy_request_buffering on;
            proxy_read_timeout 300s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location ~ ^/(upload|media|nip96|api/upload) {
            proxy_pass http://127.0.0.1:8396;
            limit_req zone=blossom_upload burst=4 nodelay;
            limit_conn blossom_conn 2;
            client_max_body_size 100m;
            proxy_request_buffering on;
            proxy_read_timeout 300s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:80;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:80;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name ca.x;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/ca.x/fullchain.pem;
        ssl_certificate_key /var/lib/acme/ca.x/key.pem;
        ssl_trusted_certificate /var/lib/acme/ca.x/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass https://localhost:1443;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /ca.crt {
            alias /nix/store/3jr13xmgmflr1vbv4fyv8cpln8hbrbmf-per-machine-cask-step-intermediate-cert_intermediate.crt;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name cache.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name cache.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:5751;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name chat.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name chat.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            root /nix/store/29y1klykqx42lfny0ixxhzj01b3iprl0-glowing-bear-0.9.0;
        }
        location /oauth2/ {
            proxy_pass http://127.0.0.1:4183;
            auth_request off;
            proxy_set_header X-Scheme $scheme;
            proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /oauth2/auth {
            proxy_pass http://127.0.0.1:4183/oauth2/auth;
            auth_request off;
            proxy_set_header X-Scheme $scheme;
            proxy_set_header Content-Length "";
            proxy_pass_request_body off;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location @redirectToOauth2ProxyLogin {
            return 307 https://chat.mulatta.io/oauth2/start?rd=$scheme://$host$request_uri;
            auth_request off;
        }
        location ^~ /weechat {
            proxy_pass http://malt.n:4242;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header X-User $user;
            proxy_set_header X-Email $email;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        auth_request /oauth2/auth;
        error_page 401 = @redirectToOauth2ProxyLogin;
        auth_request_set $user $upstream_http_x_auth_request_user;
        auth_request_set $email $upstream_http_x_auth_request_email;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name cloud.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name cloud.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:80;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_buffering off;
            proxy_request_buffering off;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /.well-known/caldav {
            return 301 $scheme://$host/remote.php/dav;
        }
        location = /.well-known/carddav {
            return 301 $scheme://$host/remote.php/dav;
        }
        location = /.well-known/nodeinfo {
            return 301 $scheme://$host/index.php/.well-known/nodeinfo;
        }
        location = /.well-known/webfinger {
            return 301 $scheme://$host/index.php/.well-known/webfinger;
        }
        client_max_body_size 16G;
        client_body_timeout 3600s;
        proxy_connect_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_read_timeout 3600s;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name headscale.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name headscale.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8089;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_buffering off;
            proxy_request_buffering off;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name home.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name home.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:8123;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_buffering off;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /.well-known/security.txt {
            return 308 https://mulatta.io/.well-known/security.txt;
        }
        location ~ ^/.well-known/ {
            return 404;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name idm.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name idm.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass https://127.0.0.1:8443;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_ssl_verify off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name links.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name links.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
        client_max_body_size 100M;
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:80;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:80;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name localhost 127.0.0.1 [::1];
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 127.0.0.1;
            allow ::1;
            deny all;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name mail.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name mail.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location /dav/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        location /jmap/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 50M;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
        }
        location = /.well-known/caldav {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        location = /.well-known/carddav {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        location = /.well-known/jmap {
            proxy_pass http://127.0.0.1:8080/jmap/session;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Accept-Encoding "";
            sub_filter "https://stalwart.mulatta.io/" "https://mail.mulatta.io/";
            sub_filter_once off;
            sub_filter_types application/json;
        }
        location = /.well-known/oauth-authorization-server {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        location = /.well-known/openid-configuration {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host stalwart.mulatta.io;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name mq.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name mq.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:18980;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name mta-sts.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name mta-sts.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location =/.well-known/mta-sts.txt {
            alias /nix/store/l3967zi6vf1mx48qldwfyzaklmycj6l0-mta-sts.txt;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            return 404;
        }
        location = /.well-known/nostr.json {
            alias /nix/store/hcp5r1cjnxif7afz86wb2xkd17jp9pd4-nostr.json;
            add_header Access-Control-Allow-Origin "*" always;
            add_header Cache-Control "public, max-age=3600";
            default_type application/json;
        }
        location = /.well-known/security.txt {
            alias /nix/store/si5gb1xwag27pbfagpw946nnbc7fwgfy-security.txt;
            default_type "text/plain; charset=utf-8";
        }
        location ^~ /.well-known/openpgpkey/ {
            alias /nix/store/dn4aksj980bfb15b1jaxsijqzzzg36vp-openpgpkey/;
            default_type "application/octet-stream";
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name n8n-api.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name n8n-api.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            return 404;
        }
        location ~ ^/(webhook(-test)?|healthz) {
            proxy_pass http://malt.n:5678;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            # SECURITY: Prevent header injection - clear all auth headers
            proxy_set_header X-Email "";
            proxy_set_header X-Auth-Request-Email "";
            proxy_set_header X-Auth-Request-User "";
            proxy_set_header X-Access-Token "";
            client_max_body_size 50M;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name n8n.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name n8n.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:4180;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            client_max_body_size 50M;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name niks3.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name niks3.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:5751;
            proxy_connect_timeout 300s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
            proxy_buffering off;
            proxy_request_buffering off;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name ntfy.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name ntfy.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:2586;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name paperless-api.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name paperless-api.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            return 404;
        }
        location ~ ^/api/ {
            proxy_pass http://malt.n:28981;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            # SECURITY: prevent auth header injection from sibling SSO setups.
            proxy_set_header X-Email "";
            proxy_set_header X-Auth-Request-Email "";
            proxy_set_header X-Auth-Request-User "";
            proxy_set_header X-Access-Token "";
            proxy_set_header Remote-User "";
            proxy_set_header Remote-Email "";
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
        client_max_body_size 256M;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name paperless.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name paperless.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:28981;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
        client_max_body_size 256M;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name rad.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name rad.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        root /nix/store/cfzffj5cyx581g4c8jrpkd5jyhns9xjs-radicle-explorer-0-unstable-2026-07-21;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            try_files $uri $uri/ /index.html;
            add_header Cache-Control "public, max-age=3600";
        }
        location /api/ {
            proxy_pass http://127.0.0.1:8889;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name radicle-mirror.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name radicle-mirror.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            return 404;
        }
        location = /github {
            proxy_pass http://127.0.0.1:4128;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name relay.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name relay.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:7777;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /.well-known/security.txt {
            return 308 https://mulatta.io/.well-known/security.txt;
        }
        location ~ ^/.well-known/ {
            return 404;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name restate-api.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name restate-api.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            return 404;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name restate.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name restate.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:4181;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            client_max_body_size 50M;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name rss.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name rss.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_hide_header Strict-Transport-Security;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        if ($block_dotted) {
            return 404;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name stalwart.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name stalwart.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 50M;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name tasks.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name tasks.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:3456;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            client_max_body_size 50M;
            proxy_read_timeout 120s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location = /.well-known/caldav {
            return 301 $scheme://$host/dav;
        }
        location = /.well-known/security.txt {
            return 308 https://mulatta.io/.well-known/security.txt;
        }
        location ~ ^/.well-known/ {
            return 404;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name upterm.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name upterm.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            root /nix/store/abmi6mhjzj206kcby0a4z4sqbw2s2vs2-uptermd;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name vaultwarden.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name vaultwarden.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8222;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        client_max_body_size 128M;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name video.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name video.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://malt.n:8096;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_buffering off;
            proxy_request_buffering off;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        if ($block_dotted) {
            return 404;
        }
        client_max_body_size 20G;
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name webmail.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name webmail.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location / {
            return 301 https://mail.mulatta.io$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name www.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name www.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location / {
            return 301 https://mulatta.io$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen 10.208.0.9:80;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;
        listen 0.0.0.0:80;
        server_name zotero.mulatta.io;
        location / {
            return 301 https://$host$request_uri;
        }
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
    }
    server {
        listen [::1]:443 quic;
        listen [::1]:443 ssl;
        listen 10.208.0.9:443 quic;
        listen 10.208.0.9:443 ssl;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;
        listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;
        listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;
        listen 0.0.0.0:443 quic;
        listen 0.0.0.0:443 ssl;
        server_name zotero.mulatta.io;
        http2 on;
        http3 on;
        http3_hq off;
        ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;
        ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;
        ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;
        location ^~ /.well-known/acme-challenge/ {
            root /var/lib/acme/acme-challenge;
            auth_basic off;
            auth_request off;
        }
        location / {
            proxy_pass http://127.0.0.1:8189;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            client_max_body_size 512M;
            proxy_request_buffering off;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location /login {
            proxy_pass http://127.0.0.1:4182;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        location /oauth2/ {
            proxy_pass http://127.0.0.1:4182;
            include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;
        }
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
    proxy_headers_hash_max_size 1024;
    proxy_headers_hash_bucket_size 128;
    map $request_uri $block_dotted {
        default 0;
        "~^/\.well-known/" 0;
        "~^/\." 1;
    }
    limit_req_zone $binary_remote_addr zone=blossom_upload:10m rate=2r/m;
    limit_conn_zone $binary_remote_addr zone=blossom_conn:10m;
}