GitLab

Horizontal endpoints are HTTP endpoints served on all domains hosted
by the infrastructure - normally used for services handling
"well-known" URLs.

There is no need to hold on to selfsigned certs once the ACME
automation takes over: this removes the requirement for the link-based
switch mechanism we had in place. We can instead just make everything
in /etc/credentials/public a real directory, create the selfsigned
cert there if missing, and just overwrite everything periodically from
the replds@acme directory.

Replace custom-errors.conf and site-limits.conf with a more generic
site-common.conf, that also includes HSTS and other top-level site
functionality.

ai3/prod#31

This reverts commit dd609e0e.

We are quite confident this won't fix the issue

using same configuration as in https://www.digitalocean.com/community/tutorials/understanding-nginx-http-proxying-load-balancing-buffering-and-caching

This reverts commit 7f991cb4.

Drop the 'nodelay' clause from the 'perip' rate limiter.

Configurable connection limits per-IP and per-server.

Allow admins to block user-agents, and specific URLs (access blocks
for legal reasons).