cmc/dotfiles

Using GNU Stow to manage my dotfiles.

clone: git clone https://gitbay.org/cmc/dotfiles.git

f4318a3e399d60ef93e9fe08d50aa3fa44794730

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-03-04T06:14:24Z

update nginx with security fixes

 linux/nginx/etc/nginx/conf.d/ao.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/art.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/auth.conf                 | 2 +-
 linux/nginx/etc/nginx/conf.d/br.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/bt.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/bw.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/cc.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/cleberg.io.conf           | 2 +-
 linux/nginx/etc/nginx/conf.d/cleberg.net.conf          | 4 ++--
 linux/nginx/etc/nginx/conf.d/cv.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/ddns.conf                 | 2 +-
 linux/nginx/etc/nginx/conf.d/default.conf              | 2 +-
 linux/nginx/etc/nginx/conf.d/docker.conf               | 2 +-
 linux/nginx/etc/nginx/conf.d/files.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/gh.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/ha.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/hat.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/hn.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/img.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/irc.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/ld.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/lemmy.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/lt.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/michelangelo.conf         | 2 +-
 linux/nginx/etc/nginx/conf.d/mz.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/office.conf               | 2 +-
 linux/nginx/etc/nginx/conf.d/org.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/paste.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/pb.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/photos.conf               | 2 +-
 linux/nginx/etc/nginx/conf.d/pin.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/piped.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/projects.conf             | 2 +-
 linux/nginx/etc/nginx/conf.d/rd.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf | 4 ++--
 linux/nginx/etc/nginx/conf.d/rimgo.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/rl.conf                   | 2 +-
 linux/nginx/etc/nginx/conf.d/rss.conf                  | 3 +--
 linux/nginx/etc/nginx/conf.d/search.conf               | 2 +-
 linux/nginx/etc/nginx/conf.d/send.conf                 | 2 +-
 linux/nginx/etc/nginx/conf.d/slash.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/small.conf                | 2 +-
 linux/nginx/etc/nginx/conf.d/ssh.conf                  | 2 +-
 linux/nginx/etc/nginx/conf.d/teddit.conf               | 2 +-
 linux/nginx/etc/nginx/conf.d/wyl.conf                  | 2 +-
 linux/nginx/etc/nginx/nginx.conf                       | 3 ---
 46 files changed, 47 insertions(+), 51 deletions(-)

diff --git a/linux/nginx/etc/nginx/conf.d/ao.conf b/linux/nginx/etc/nginx/conf.d/ao.conf
index 1c7b3be..a18fac4 100644
--- a/linux/nginx/etc/nginx/conf.d/ao.conf
+++ b/linux/nginx/etc/nginx/conf.d/ao.conf
@@ -5,7 +5,7 @@ server {
 	server_name ao.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:9380;
diff --git a/linux/nginx/etc/nginx/conf.d/art.conf b/linux/nginx/etc/nginx/conf.d/art.conf
index 8944f5c..1ffe9e2 100644
--- a/linux/nginx/etc/nginx/conf.d/art.conf
+++ b/linux/nginx/etc/nginx/conf.d/art.conf
@@ -5,7 +5,7 @@ server {
 	server_name art.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:3003;
diff --git a/linux/nginx/etc/nginx/conf.d/auth.conf b/linux/nginx/etc/nginx/conf.d/auth.conf
index 61ffcfc..d7be68e 100644
--- a/linux/nginx/etc/nginx/conf.d/auth.conf
+++ b/linux/nginx/etc/nginx/conf.d/auth.conf
@@ -5,7 +5,7 @@ server {
 	server_name auth.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
     set $upstream http://127.0.0.1:9092;
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/br.conf b/linux/nginx/etc/nginx/conf.d/br.conf
index 1cccdee..5c60087 100644
--- a/linux/nginx/etc/nginx/conf.d/br.conf
+++ b/linux/nginx/etc/nginx/conf.d/br.conf
@@ -5,7 +5,7 @@ server {
 	server_name br.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
     location / {
 		set $upstream http://127.0.0.1:3030;
diff --git a/linux/nginx/etc/nginx/conf.d/bt.conf b/linux/nginx/etc/nginx/conf.d/bt.conf
index 7e4d11f..0bf3fef 100644
--- a/linux/nginx/etc/nginx/conf.d/bt.conf
+++ b/linux/nginx/etc/nginx/conf.d/bt.conf
@@ -5,7 +5,7 @@ server {
 	server_name bt.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
     set $upstream http://127.0.0.1:9091;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
diff --git a/linux/nginx/etc/nginx/conf.d/bw.conf b/linux/nginx/etc/nginx/conf.d/bw.conf
index 45fbc8c..b903d8e 100644
--- a/linux/nginx/etc/nginx/conf.d/bw.conf
+++ b/linux/nginx/etc/nginx/conf.d/bw.conf
@@ -5,7 +5,7 @@ server {
     server_name bw.cleberg.net;
     include custom.d/tls/ssl_engine.conf;
     include custom.d/tls/certificate_files.conf;
-    include custom.d/tls/policy_balanced.conf;
+    include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / {
              set $upstream http://127.0.0.1:10416;
diff --git a/linux/nginx/etc/nginx/conf.d/cc.conf b/linux/nginx/etc/nginx/conf.d/cc.conf
index d37f336..753cf6c 100644
--- a/linux/nginx/etc/nginx/conf.d/cc.conf
+++ b/linux/nginx/etc/nginx/conf.d/cc.conf
@@ -5,7 +5,7 @@ server {
 	server_name cc.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8111;
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
index 602f602..082f17c 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf
@@ -4,7 +4,7 @@ server {
 	http2 on;
 	server_name cleberg.io;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	ssl_certificate         /etc/letsencrypt/live/cleberg.io/fullchain.pem;
 	ssl_certificate_key     /etc/letsencrypt/live/cleberg.io/privkey.pem;
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
index 0570488..b8e6706 100644
--- a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
+++ b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf
@@ -5,7 +5,7 @@ server {
 	server_name www.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	return 301 $scheme://cleberg.net$request_uri;
 }
 
@@ -16,7 +16,7 @@ server {
 	server_name cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/cleberg.net/;
 
diff --git a/linux/nginx/etc/nginx/conf.d/cv.conf b/linux/nginx/etc/nginx/conf.d/cv.conf
index 7630e8c..1ad3771 100644
--- a/linux/nginx/etc/nginx/conf.d/cv.conf
+++ b/linux/nginx/etc/nginx/conf.d/cv.conf
@@ -5,7 +5,7 @@ server {
 	server_name cv.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/cv/;
 	autoindex on;
diff --git a/linux/nginx/etc/nginx/conf.d/ddns.conf b/linux/nginx/etc/nginx/conf.d/ddns.conf
index bf0d65d..7e0f1b1 100644
--- a/linux/nginx/etc/nginx/conf.d/ddns.conf
+++ b/linux/nginx/etc/nginx/conf.d/ddns.conf
@@ -5,7 +5,7 @@ server {
 	server_name ddns.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/default.conf b/linux/nginx/etc/nginx/conf.d/default.conf
index e603a69..3aa1909 100644
--- a/linux/nginx/etc/nginx/conf.d/default.conf
+++ b/linux/nginx/etc/nginx/conf.d/default.conf
@@ -5,7 +5,7 @@ server {
     server_name _;
     include custom.d/tls/ssl_engine.conf;
     include custom.d/tls/certificate_files.conf;
-    include custom.d/tls/policy_balanced.conf;
+    include custom.d/tls/policy_strict.conf;
     return 444;
 }
 
diff --git a/linux/nginx/etc/nginx/conf.d/docker.conf b/linux/nginx/etc/nginx/conf.d/docker.conf
index a3375c4..99ccd94 100644
--- a/linux/nginx/etc/nginx/conf.d/docker.conf
+++ b/linux/nginx/etc/nginx/conf.d/docker.conf
@@ -5,7 +5,7 @@ server {
 	server_name docker.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/files.conf b/linux/nginx/etc/nginx/conf.d/files.conf
index c267f12..090a51a 100644
--- a/linux/nginx/etc/nginx/conf.d/files.conf
+++ b/linux/nginx/etc/nginx/conf.d/files.conf
@@ -5,7 +5,7 @@ server {
 	server_name files.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/files/;
 	autoindex on;
diff --git a/linux/nginx/etc/nginx/conf.d/gh.conf b/linux/nginx/etc/nginx/conf.d/gh.conf
index f328756..e43a25a 100644
--- a/linux/nginx/etc/nginx/conf.d/gh.conf
+++ b/linux/nginx/etc/nginx/conf.d/gh.conf
@@ -5,7 +5,7 @@ server {
 	server_name gh.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://192.168.0.251:3039;
diff --git a/linux/nginx/etc/nginx/conf.d/ha.conf b/linux/nginx/etc/nginx/conf.d/ha.conf
index 97a5fba..75e1a38 100644
--- a/linux/nginx/etc/nginx/conf.d/ha.conf
+++ b/linux/nginx/etc/nginx/conf.d/ha.conf
@@ -5,7 +5,7 @@ server {
 	server_name ha.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	set $upstream http://192.168.0.214:8123;
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/hat.conf b/linux/nginx/etc/nginx/conf.d/hat.conf
index a5710d8..8fcc1e7 100644
--- a/linux/nginx/etc/nginx/conf.d/hat.conf
+++ b/linux/nginx/etc/nginx/conf.d/hat.conf
@@ -5,7 +5,7 @@ server {
 	server_name hat.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://192.168.0.251:3991;
diff --git a/linux/nginx/etc/nginx/conf.d/hn.conf b/linux/nginx/etc/nginx/conf.d/hn.conf
index efbf913..a68e45f 100644
--- a/linux/nginx/etc/nginx/conf.d/hn.conf
+++ b/linux/nginx/etc/nginx/conf.d/hn.conf
@@ -8,7 +8,7 @@ server {
     add_header Onion-Location http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion;
     include custom.d/tls/ssl_engine.conf;
     include custom.d/tls/certificate_files.conf;
-    include custom.d/tls/policy_balanced.conf;
+    include custom.d/tls/policy_strict.conf;
     include custom.d/basic.conf;
     location / { try_files $uri $uri/ /index.html; }
 }
diff --git a/linux/nginx/etc/nginx/conf.d/img.conf b/linux/nginx/etc/nginx/conf.d/img.conf
index a6c32f3..51a7fa0 100644
--- a/linux/nginx/etc/nginx/conf.d/img.conf
+++ b/linux/nginx/etc/nginx/conf.d/img.conf
@@ -5,7 +5,7 @@ server {
 	server_name img.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	root /var/www/img/;
 	autoindex on;
diff --git a/linux/nginx/etc/nginx/conf.d/irc.conf b/linux/nginx/etc/nginx/conf.d/irc.conf
index dbd45b7..b8fc123 100644
--- a/linux/nginx/etc/nginx/conf.d/irc.conf
+++ b/linux/nginx/etc/nginx/conf.d/irc.conf
@@ -5,7 +5,7 @@ server {
 	server_name irc.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/ld.conf b/linux/nginx/etc/nginx/conf.d/ld.conf
index 9f0b345..0786de2 100644
--- a/linux/nginx/etc/nginx/conf.d/ld.conf
+++ b/linux/nginx/etc/nginx/conf.d/ld.conf
@@ -5,7 +5,7 @@ server {
 	server_name ld.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:3004;
diff --git a/linux/nginx/etc/nginx/conf.d/lemmy.conf b/linux/nginx/etc/nginx/conf.d/lemmy.conf
index dc165f9..cc7eeb9 100644
--- a/linux/nginx/etc/nginx/conf.d/lemmy.conf
+++ b/linux/nginx/etc/nginx/conf.d/lemmy.conf
@@ -5,7 +5,7 @@ server {
 	server_name lemmy.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:10633;
diff --git a/linux/nginx/etc/nginx/conf.d/lt.conf b/linux/nginx/etc/nginx/conf.d/lt.conf
index f408dc4..39b1a99 100644
--- a/linux/nginx/etc/nginx/conf.d/lt.conf
+++ b/linux/nginx/etc/nginx/conf.d/lt.conf
@@ -5,7 +5,7 @@ server {
 	server_name lt.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:5000;
diff --git a/linux/nginx/etc/nginx/conf.d/michelangelo.conf b/linux/nginx/etc/nginx/conf.d/michelangelo.conf
index 9a2a475..53e751f 100644
--- a/linux/nginx/etc/nginx/conf.d/michelangelo.conf
+++ b/linux/nginx/etc/nginx/conf.d/michelangelo.conf
@@ -4,7 +4,7 @@ server {
 	server_name michelangelo.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/mz.conf b/linux/nginx/etc/nginx/conf.d/mz.conf
index 7773d73..4a06e46 100644
--- a/linux/nginx/etc/nginx/conf.d/mz.conf
+++ b/linux/nginx/etc/nginx/conf.d/mz.conf
@@ -5,7 +5,7 @@ server {
 	server_name mz.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:3474;
diff --git a/linux/nginx/etc/nginx/conf.d/office.conf b/linux/nginx/etc/nginx/conf.d/office.conf
index ef06300..0ac26f2 100644
--- a/linux/nginx/etc/nginx/conf.d/office.conf
+++ b/linux/nginx/etc/nginx/conf.d/office.conf
@@ -6,7 +6,7 @@ server {
 	root /var/www/office/;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
\ No newline at end of file
diff --git a/linux/nginx/etc/nginx/conf.d/org.conf b/linux/nginx/etc/nginx/conf.d/org.conf
index 9b82411..61302d1 100644
--- a/linux/nginx/etc/nginx/conf.d/org.conf
+++ b/linux/nginx/etc/nginx/conf.d/org.conf
@@ -6,7 +6,7 @@ server {
 	root /var/www/org/;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
\ No newline at end of file
diff --git a/linux/nginx/etc/nginx/conf.d/paste.conf b/linux/nginx/etc/nginx/conf.d/paste.conf
index 0a71a68..0cb16a2 100644
--- a/linux/nginx/etc/nginx/conf.d/paste.conf
+++ b/linux/nginx/etc/nginx/conf.d/paste.conf
@@ -5,7 +5,7 @@ server {
 	server_name paste.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8084;
diff --git a/linux/nginx/etc/nginx/conf.d/pb.conf b/linux/nginx/etc/nginx/conf.d/pb.conf
index 4423248..e714d6d 100644
--- a/linux/nginx/etc/nginx/conf.d/pb.conf
+++ b/linux/nginx/etc/nginx/conf.d/pb.conf
@@ -5,7 +5,7 @@ server {
 	server_name pb.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8745;
diff --git a/linux/nginx/etc/nginx/conf.d/photos.conf b/linux/nginx/etc/nginx/conf.d/photos.conf
index c264da3..88b4d5b 100644
--- a/linux/nginx/etc/nginx/conf.d/photos.conf
+++ b/linux/nginx/etc/nginx/conf.d/photos.conf
@@ -5,7 +5,7 @@ server {
 	server_name photos.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	client_max_body_size 50000M;
 	proxy_set_header Host              $host;
diff --git a/linux/nginx/etc/nginx/conf.d/pin.conf b/linux/nginx/etc/nginx/conf.d/pin.conf
index 0ce6be5..1b0b9c7 100644
--- a/linux/nginx/etc/nginx/conf.d/pin.conf
+++ b/linux/nginx/etc/nginx/conf.d/pin.conf
@@ -5,7 +5,7 @@ server {
 	server_name pin.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8086;
diff --git a/linux/nginx/etc/nginx/conf.d/piped.conf b/linux/nginx/etc/nginx/conf.d/piped.conf
index 022c8e8..af9fd26 100644
--- a/linux/nginx/etc/nginx/conf.d/piped.conf
+++ b/linux/nginx/etc/nginx/conf.d/piped.conf
@@ -5,7 +5,7 @@ server {
 	server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8077;
diff --git a/linux/nginx/etc/nginx/conf.d/projects.conf b/linux/nginx/etc/nginx/conf.d/projects.conf
index f04c72b..05ab7a7 100644
--- a/linux/nginx/etc/nginx/conf.d/projects.conf
+++ b/linux/nginx/etc/nginx/conf.d/projects.conf
@@ -7,7 +7,7 @@ server {
 	autoindex on;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / { try_files $uri $uri/ /index.html; }
 }
diff --git a/linux/nginx/etc/nginx/conf.d/rd.conf b/linux/nginx/etc/nginx/conf.d/rd.conf
index 3f19469..0e29b8f 100644
--- a/linux/nginx/etc/nginx/conf.d/rd.conf
+++ b/linux/nginx/etc/nginx/conf.d/rd.conf
@@ -5,7 +5,7 @@ server {
 	server_name rd.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:2944;
diff --git a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
index 9a173d1..818e7eb 100644
--- a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
+++ b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf
@@ -4,7 +4,7 @@ server {
 	http2 on;
 	server_name www.reminiscecleberg.com;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
 	ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
 	ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem;
@@ -19,7 +19,7 @@ server {
 	server_name reminiscecleberg.com;
 	root /var/www/reminiscecleberg.com/;
 	include custom.d/tls/ssl_engine.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	ssl_certificate         /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem;
 	ssl_certificate_key     /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem;
diff --git a/linux/nginx/etc/nginx/conf.d/rimgo.conf b/linux/nginx/etc/nginx/conf.d/rimgo.conf
index 9ae6975..734af08 100644
--- a/linux/nginx/etc/nginx/conf.d/rimgo.conf
+++ b/linux/nginx/etc/nginx/conf.d/rimgo.conf
@@ -5,7 +5,7 @@ server {
 	server_name rimgo.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:3869;
diff --git a/linux/nginx/etc/nginx/conf.d/rl.conf b/linux/nginx/etc/nginx/conf.d/rl.conf
index 8492361..8351fa5 100644
--- a/linux/nginx/etc/nginx/conf.d/rl.conf
+++ b/linux/nginx/etc/nginx/conf.d/rl.conf
@@ -5,7 +5,7 @@ server {
 	server_name rl.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/rss.conf b/linux/nginx/etc/nginx/conf.d/rss.conf
index 0a74a72..a31c565 100644
--- a/linux/nginx/etc/nginx/conf.d/rss.conf
+++ b/linux/nginx/etc/nginx/conf.d/rss.conf
@@ -6,12 +6,11 @@ server {
 	server_name rss.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		proxy_pass http://freshrss/;
 		add_header X-Frame-Options SAMEORIGIN;
-		add_header X-XSS-Protection "1; mode=block";
 		proxy_redirect off;
 		proxy_buffering off;
 		proxy_set_header Host $host;
diff --git a/linux/nginx/etc/nginx/conf.d/search.conf b/linux/nginx/etc/nginx/conf.d/search.conf
index 3fc35f6..12bb13b 100644
--- a/linux/nginx/etc/nginx/conf.d/search.conf
+++ b/linux/nginx/etc/nginx/conf.d/search.conf
@@ -5,7 +5,7 @@ server {
 	server_name search.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:9191;
diff --git a/linux/nginx/etc/nginx/conf.d/send.conf b/linux/nginx/etc/nginx/conf.d/send.conf
index cbdc71d..00d8af1 100644
--- a/linux/nginx/etc/nginx/conf.d/send.conf
+++ b/linux/nginx/etc/nginx/conf.d/send.conf
@@ -5,7 +5,7 @@ server {
 	server_name send.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://192.168.0.251:1443;
diff --git a/linux/nginx/etc/nginx/conf.d/slash.conf b/linux/nginx/etc/nginx/conf.d/slash.conf
index 702cca4..7169138 100644
--- a/linux/nginx/etc/nginx/conf.d/slash.conf
+++ b/linux/nginx/etc/nginx/conf.d/slash.conf
@@ -5,7 +5,7 @@ server {
 	server_name slash.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://192.168.0.251:5231;
diff --git a/linux/nginx/etc/nginx/conf.d/small.conf b/linux/nginx/etc/nginx/conf.d/small.conf
index 46f1099..76d7c04 100644
--- a/linux/nginx/etc/nginx/conf.d/small.conf
+++ b/linux/nginx/etc/nginx/conf.d/small.conf
@@ -5,7 +5,7 @@ server {
 	server_name small.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location / {
 		set $upstream http://127.0.0.1:8002;
diff --git a/linux/nginx/etc/nginx/conf.d/ssh.conf b/linux/nginx/etc/nginx/conf.d/ssh.conf
index b8904ed..8aaf3ba 100644
--- a/linux/nginx/etc/nginx/conf.d/ssh.conf
+++ b/linux/nginx/etc/nginx/conf.d/ssh.conf
@@ -5,7 +5,7 @@ server {
 	server_name ssh.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/teddit.conf b/linux/nginx/etc/nginx/conf.d/teddit.conf
index ad62af3..5d3ea29 100644
--- a/linux/nginx/etc/nginx/conf.d/teddit.conf
+++ b/linux/nginx/etc/nginx/conf.d/teddit.conf
@@ -5,7 +5,7 @@ server {
 	server_name teddit.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/conf.d/wyl.conf b/linux/nginx/etc/nginx/conf.d/wyl.conf
index 092f110..6666901 100644
--- a/linux/nginx/etc/nginx/conf.d/wyl.conf
+++ b/linux/nginx/etc/nginx/conf.d/wyl.conf
@@ -5,7 +5,7 @@ server {
 	server_name wyl.cleberg.net;
 	include custom.d/tls/ssl_engine.conf;
 	include custom.d/tls/certificate_files.conf;
-	include custom.d/tls/policy_balanced.conf;
+	include custom.d/tls/policy_strict.conf;
 	include custom.d/basic.conf;
 	location /authelia { include custom.d/reverse_proxy/authelia.conf; }
 	location / {
diff --git a/linux/nginx/etc/nginx/nginx.conf b/linux/nginx/etc/nginx/nginx.conf
index 9c3ac65..13301ad 100644
--- a/linux/nginx/etc/nginx/nginx.conf
+++ b/linux/nginx/etc/nginx/nginx.conf
@@ -202,13 +202,11 @@ http {
     bw.cleberg.net      http://127.0.0.1:10416;
     cc.cleberg.net      http://127.0.0.1:8111;
     ddns.cleberg.net    http://127.0.0.1:8097;
-    docker.cleberg.net  http://127.0.0.1:3777;
     gh.cleberg.net      http://192.168.0.251:3039;
     ha.cleberg.net      http://192.168.0.214:8123;
     hat.cleberg.net     http://192.168.0.251:3991;
     irc.cleberg.net     http://192.168.0.251:9900;
     ld.cleberg.net      http://127.0.0.1:3004;
-    lemmy.cleberg.net   http://127.0.0.1:10633;
     lt.cleberg.net      http://127.0.0.1:5000;
     mz.cleberg.net      http://127.0.0.1:3474;
     paste.cleberg.net   http://127.0.0.1:8084;
@@ -225,7 +223,6 @@ http {
     slash.cleberg.net   http://192.168.0.251:5231;
     small.cleberg.net   http://127.0.0.1:8002;
     ssh.cleberg.net     http://127.0.0.1:8169;
-    teddit.cleberg.net  http://192.168.0.251:8181;
     wyl.cleberg.net     http://192.168.0.251:8840;
   }