diff --git a/002-searx.conf b/002-searx.conf
new file mode 100644
index 0000000..4616062
--- /dev/null
+++ b/002-searx.conf
@@ -0,0 +1,108 @@
+
+##
+# SEARX config
+##
+
+geo $limit {
+    default 1;
+    192.124.237.237 0;
+}
+
+map $limit $limit_key {
+    0 "";
+    1 $binary_remote_addr;
+}
+
+limit_req_zone $limit_key zone=search:10m rate=5r/s;
+
+
+
+
+server {
+    listen 80;
+    server_name searx.solusar.de www.searx.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name www.searx.solusar.de;
+
+    location / {
+      return 301 https://searx.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/searx.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    #add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' http: https:; font-src 'self' data: http: https:; object-src 'none';";
+    add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' https://searx.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';";
+
+    # default-src 'none'; font-src 'self'; script-src 'self' 'sha256-IP0Wu+32AyU/oDc6ZoLyf8izu/2fUvR7RAEf81sddNk='; img-src * data:; object-src 'none'; style-src 'self' 'sha256-PEo9RAB0C7Pw0EzsgS+HuVOHFPZRr93dZNJ9mYzz95A=' 'sha256-lrhGtO62QsLjBNsk1WGpvRZbHmXYMG/CmjhMFhLDJpg=' 'sha256-4SHcbKIX1Fx5rhlottWqqHggM5MSJz+xg9uwwq8UK74=' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg=' 'sha256-yIJ6JcbosmUis6IDdnDV7NU2qPkU/1KUJHRwj44Q32o='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self'; report-uri https://csp.itronic.at/report.php;
+}
+
+server {
+    #listen 80;
+    listen 443 ssl http2;
+
+    access_log /var/log/nginx/002-searx-access.log;
+    error_log /var/log/nginx/002-searx-error.log;
+
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/searx.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    #add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' http: https:; font-src 'self' data: http: https:; object-src 'none';";
+    add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' https://searx.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';";
+
+    server_name searx.solusar.de;
+
+    location / {
+        limit_req zone=search burst=10 nodelay;
+        #limit_except GET {
+        #    allow 192.124.237.237;
+        #    allow 5.9.58.49;
+        #    deny all;
+        #}
+        if ($http_user_agent ~ (curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|UniversalFeedParser|feedparser|Ruby) ) {
+            return 403;
+        }
+        if ($query_string = "format=rss" ) { return 403; }
+        if ($query_string = "format=json" ) { return 403; }
+        proxy_set_header	Host		$host;
+        proxy_set_header	X-Real-IP	$remote_addr;
+        proxy_set_header 	X-Forwarded-For	$proxy_add_x_forwarded_for;
+        proxy_set_header 	X-Scheme 	$scheme;
+        #proxy_buffering off;
+        proxy_pass http://localhost:4004;
+    }
+}
diff --git a/003-postfix.conf b/003-postfix.conf
new file mode 100644
index 0000000..ca69dae
--- /dev/null
+++ b/003-postfix.conf
@@ -0,0 +1,72 @@
+
+
+##
+# POSTFIX site
+##
+
+server {
+    listen 80;
+    server_name postfix.solusar.de www.postfix.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name www.postfix.solusar.de;
+
+    location / {
+      return 301 https://postfix.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/postfix.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl http2;
+
+    server_name postfix.solusar.de;
+
+    access_log /var/log/nginx/003-postfix-access.log;
+    error_log /var/log/nginx/003-postfix-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/postfix.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    root /var/www/vhosts/solusar.de/subdomains/postfix/public;
+    index index.php
+
+    include global/restrictions.conf;
+    include global/php.conf;
+}
diff --git a/004-diaspora.conf b/004-diaspora.conf
new file mode 100644
index 0000000..58cee42
--- /dev/null
+++ b/004-diaspora.conf
@@ -0,0 +1,125 @@
+server {
+    listen 80;
+    server_name diaspora.solusar.de www.diaspora.example.org;
+    
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+  # Redirect https://www.diaspora.example.org to https://diaspora.example.org
+server {
+    listen 443 ssl http2;  # Same rules as for listen [::]:80 apply.
+
+    server_name www.diaspora.solusar.de;
+    
+    location / {
+      return 301 https://diaspora.solusar.de$request_uri;
+    }
+
+    # SSL setup
+
+    # This file should also include any necessary intermediate certificates.
+    # For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
+    # For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
+    # and /etc/letsencrypt/diaspora.example.org/privkey.pem
+    ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+
+    # Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
+    # You might want to make these global
+
+    # generate with openssl dhparam 2048 > /path/to/dhparam.pem
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+  # Actual proxy
+
+server {
+    listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
+    server_name diaspora.solusar.de;
+    root /home/diaspora/diaspora/public;
+
+    access_log /var/log/nginx/004-diaspora-access.log;
+    error_log /var/log/nginx/004-diaspora-error.log;
+
+    # Configure maximum picture size
+    # Note that Diaspora has a client side check set at 4M
+    client_max_body_size 5M;
+    client_body_buffer_size 256K;
+
+    # SSL setup
+
+    # This file should also include any necessary intermediate certificates.
+    # For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
+    # For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
+    # and /etc/letsencrypt/diaspora.example.org/privkey.pem
+    ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+
+    # Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
+    # You might want to make these global
+
+    # generate with openssl dhparam 2048 > /path/to/dhparam.pem
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    # Proxy if requested file not found
+    try_files $uri @diaspora;
+
+    location /assets/ {
+      expires max;
+      add_header Cache-Control public;
+    }
+
+    # Camo support
+    #location /camo/ {
+    #  proxy_redirect off;
+    #  proxy_pass http://camo/;
+    #  break;
+    #}
+
+    location @diaspora {
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_redirect off;
+
+      proxy_pass http://localhost:3000;
+    }
+}
+
+  # Proxy destination
+  # Add as many server directives as you want
+  # Also takes a socket, like unix:/path/to/some/socket.sock
+#upstream diaspora_server {
+#    server unix:/home/diaspora/diaspora/tmp/diaspora.sock;
+#}
+
+# Camo support
+#upstream camo {
+#  server 127.0.0.1:8081;
+#}
+
diff --git a/004-diaspora.conf.save b/004-diaspora.conf.save
new file mode 100644
index 0000000..582623b
--- /dev/null
+++ b/004-diaspora.conf.save
@@ -0,0 +1,125 @@
+server {
+    listen 80;
+    server_name diaspora.solusar.de www.diaspora.example.org;
+    
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+  # Redirect https://www.diaspora.example.org to https://diaspora.example.org
+server {
+    listen 443 ssl spdy;  # Same rules as for listen [::]:80 apply.
+
+    server_name www.diaspora.solusar.de;
+    
+    location / {
+      return 301 https://diaspora.solusar.de$request_uri;
+    }
+
+    # SSL setup
+
+    # This file should also include any necessary intermediate certificates.
+    # For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
+    # For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
+    # and /etc/letsencrypt/diaspora.example.org/privkey.pem
+    ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+
+    # Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
+    # You might want to make these global
+
+    # generate with openssl dhparam 2048 > /path/to/dhparam.pem
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+  # Actual proxy
+
+server {
+    listen 443 ssl spdy; # Same rules as for listen [::]:80 apply.
+    server_name diaspora.solusar.de;
+    root /home/diaspora/diaspora/public;
+
+    access_log /var/log/nginx/004-diaspora-access.log;
+    error_log /var/log/nginx/004-diaspora-error.log;
+
+    # Configure maximum picture size
+    # Note that Diaspora has a client side check set at 4M
+    client_max_body_size 10M;
+    client_body_buffer_size 512K;
+
+    # SSL setup
+
+    # This file should also include any necessary intermediate certificates.
+    # For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
+    # For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
+    # and /etc/letsencrypt/diaspora.example.org/privkey.pem
+    ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
+
+    # Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
+    # You might want to make these global
+
+    # generate with openssl dhparam 2048 > /path/to/dhparam.pem
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    # Proxy if requested file not found
+    try_files $uri @diaspora;
+
+    location /assets/ {
+      expires max;
+      add_header Cache-Control public;
+    }
+
+    # Camo support
+    #location /camo/ {
+    #  proxy_redirect off;
+    #  proxy_pass http://camo/;
+    #  break;
+    #}
+
+    location @diaspora {
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Host $http_host;
+      proxy_redirect off;
+
+      proxy_pass http://localhost:3000;
+    }
+}
+
+  # Proxy destination
+  # Add as many server directives as you want
+  # Also takes a socket, like unix:/path/to/some/socket.sock
+#upstream diaspora_server {
+#    server unix:/home/diaspora/diaspora/tmp/diaspora.sock;
+#}
+
+# Camo support
+#upstream camo {
+#  server 127.0.0.1:8081;
+#}
+
diff --git a/005-matrix.conf b/005-matrix.conf
new file mode 100644
index 0000000..5793d31
--- /dev/null
+++ b/005-matrix.conf
@@ -0,0 +1,133 @@
+server {
+    listen 80;
+    server_name matrix.solusar.de www.matrix.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;  # Same rules as for listen [::]:80 apply.
+    server_name www.matrix.solusar.de;
+
+    location / {
+      return 301 https://matrix.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl;
+    #listen [::]:443 ssl;
+    
+    server_name matrix.solusar.de;
+
+    access_log /var/log/nginx/005-matrix-access.log;
+    error_log /var/log/nginx/005-matrix-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    #index index.html index.htm;
+
+    #location /.well-known/matrix/ {
+    #    root /var/www/vhosts/solusar.de/subdomains/matrix/;
+    #    default_type application/json;
+    #    add_header Access-Control-Allow-Origin  *;
+    #}
+
+    location / {
+        proxy_pass http://localhost:8008;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        client_max_body_size 128m;
+    }
+
+    location /.well-known/matrix/ {
+        root /opt/synapse/nginx/www/;
+        default_type application/json;
+        add_header Access-Control-Allow-Origin  *;
+    }
+    
+}
+
+server {
+    listen 8448 ssl default_server;
+    #listen [::]:8448 ssl default_server;
+    
+    server_name matrix.solusar.de;
+
+    access_log /var/log/nginx/005-matrix-access.log;
+    #access_log off;
+    error_log /var/log/nginx/005-matrix-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    #index index.html index.htm;
+
+    #location /.well-known/matrix/ {
+    #    root /var/www/vhosts/solusar.de/subdomains/matrix/;
+    #    default_type application/json;
+    #    add_header Access-Control-Allow-Origin  *;
+    #}
+
+    location / {
+        proxy_pass http://localhost:8008;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        client_max_body_size 128m;
+    }
+
+    location /.well-known/matrix/ {
+        root /opt/synapse/nginx/www/;
+        default_type application/json;
+        add_header Access-Control-Allow-Origin  *;
+    }
+    
+}
+
+
diff --git a/006-riot.conf b/006-riot.conf
new file mode 100644
index 0000000..73c3f14
--- /dev/null
+++ b/006-riot.conf
@@ -0,0 +1,76 @@
+
+
+##
+# POSTFIX site
+##
+
+server {
+    listen 80;
+    server_name riot.solusar.de www.riot.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl spdy;  # Same rules as for listen [::]:80 apply.
+    server_name www.riot.solusar.de;
+
+    location / {
+      return 301 https://riot.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riot.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl spdy;
+
+    server_name riot.solusar.de;
+
+    access_log /var/log/nginx/006-riot-access.log;
+    error_log /var/log/nginx/006-riot-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riot.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    root /var/www/vhosts/solusar.de/subdomains/riot;
+    index index.html index.htm;
+    
+    location / {
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    #include global/restrictions.conf;
+    #include global/php.conf;
+}
diff --git a/007-indra.conf b/007-indra.conf
new file mode 100644
index 0000000..2687e71
--- /dev/null
+++ b/007-indra.conf
@@ -0,0 +1,72 @@
+
+
+##
+# Indras site
+##
+
+server {
+    listen 80;
+    server_name indra.solusar.de www.indra.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;  # Same rules as for listen [::]:80 apply.
+    server_name www.indra.solusar.de;
+
+    location / {
+      return 301 https://indra.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/indra.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl http2;
+
+    server_name indra.solusar.de;
+
+    access_log /var/log/nginx/007-indra-access.log;
+    error_log /var/log/nginx/007-indra-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/indra.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    root /var/www/vhosts/solusar.de/subdomains/indra;
+    index index.php
+
+    include global/restrictions.conf;
+    include global/php.conf;
+}
diff --git a/008-wiki.conf b/008-wiki.conf
new file mode 100644
index 0000000..e7d2ce5
--- /dev/null
+++ b/008-wiki.conf
@@ -0,0 +1,73 @@
+
+
+##
+# POSTFIX site
+##
+
+server {
+    listen 80;
+    server_name wiki.solusar.de www.wiki.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;  # Same rules as for listen [::]:80 apply.
+    server_name www.wiki.solusar.de;
+
+    location / {
+      return 301 https://wiki.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/wiki.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl http2;
+
+    server_name wiki.solusar.de;
+
+    access_log /var/log/nginx/008-wiki-access.log;
+    error_log /var/log/nginx/008-wiki-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/wiki.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    #ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+
+    root /var/www/vhosts/solusar.de/subdomains/wiki;
+    index index.php
+
+    include global/restrictions.conf;
+    include global/php.conf;
+}
diff --git a/009-webmail.conf b/009-webmail.conf
new file mode 100644
index 0000000..5cd97c1
--- /dev/null
+++ b/009-webmail.conf
@@ -0,0 +1,72 @@
+
+
+##
+# POSTFIX site
+##
+
+server {
+    listen 80;
+    server_name webmail.solusar.de www.webmail.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;  # Same rules as for listen [::]:80 apply.
+    server_name www.webmail.solusar.de;
+
+    location / {
+      return 301 https://webmail.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/webmail.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl http2;
+
+    server_name webmail.solusar.de;
+
+    access_log /var/log/nginx/009-webmail-access.log;
+    error_log /var/log/nginx/009-webmail-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/webmail.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    root /var/www/vhosts/solusar.de/subdomains/webmail;
+    index index.php
+
+    include global/restrictions.conf;
+    include global/php.conf;
+}
diff --git a/010-gitea.conf b/010-gitea.conf
new file mode 100644
index 0000000..c7e2cb1
--- /dev/null
+++ b/010-gitea.conf
@@ -0,0 +1,76 @@
+
+
+##
+# POSTFIX site
+##
+
+server {
+    listen 80;
+    server_name gitea.solusar.de www.gitea.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;  # Same rules as for listen [::]:80 apply.
+    server_name www.gitea.solusar.de;
+
+    location / {
+      return 301 https://gitea.solusar.de$request_uri;
+    }
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gitea.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl http2;
+
+    server_name gitea.solusar.de;
+
+    access_log /var/log/nginx/010-gitea-access.log;
+    error_log /var/log/nginx/010-gitea-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gitea.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    #root /var/www/vhosts/solusar.de/subdomains/gitea;
+    #index index.php
+
+    #include global/restrictions.conf;
+    #include global/php.conf;
+
+    location / {
+        proxy_pass http://localhost:4001;
+    }
+}
diff --git a/011-grafana.conf b/011-grafana.conf
new file mode 100644
index 0000000..b36a4a8
--- /dev/null
+++ b/011-grafana.conf
@@ -0,0 +1,76 @@
+
+
+##
+# GRAFANA
+##
+
+server {
+    listen 80;
+    server_name grafana.solusar.de www.grafana.solusar.de;
+
+    location / {
+      return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;  # Same rules as for listen [::]:80 apply.
+    server_name www.grafana.solusar.de;
+
+    location / {
+      return 301 https://grafana.solusar.de$request_uri;
+    }
+
+    ssl on;
+    ssl_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/grafana.solusar.de/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+}
+
+server {
+    listen 443 ssl;
+
+    server_name grafana.solusar.de;
+
+    access_log /var/log/nginx/011-grafana-access.log;
+    error_log /var/log/nginx/011-grafana-error.log;
+
+    ssl on;
+    ssl_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/grafana.solusar.de/privkey.pem;
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    #root /var/www/vhosts/solusar.de/subdomains/awstats;
+    #index index.php
+
+    #include global/restrictions.conf;
+    #include global/php.conf;
+    
+    location / {
+        proxy_pass http://localhost:3001;
+    }
+}
diff --git a/default b/default
new file mode 100644
index 0000000..c52b4ab
--- /dev/null
+++ b/default
@@ -0,0 +1,72 @@
+# Default server configuration
+#
+
+server {
+    listen 80 default_server;
+    server_name solusar.de www.solusar.de;
+    
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2 default_server;
+
+    server_name solusar.de www.solusar.de;
+    
+    access_log /var/log/nginx/default-access.log;
+    error_log /var/log/nginx/default-error.log;
+
+    #ssl on;
+    ssl_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.solusar.de/privkey.pem;
+
+
+    ssl_dhparam /etc/myssl/dh4096.pem;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Content-Security-Policy "default-src 'none'; child-src 'self'; connect-src 'self'; img-src 'self' data: https: *.gravatar.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' cdn.jsdelivr.net api.instagram.com pagead2.googlesyndication.com; style-src 'self' 'unsafe-inline' https: fonts.googleapis.com; font-src 'self' data: https: fonts.googleapis.com themes.googleusercontent.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' www.paypal.com; media-src https:;";
+
+    #limit_req zone=one burst=10;
+
+    root /var/www/vhosts/solusar.de/httpdocs;
+    index index.php;
+
+    include global/restrictions.conf;
+    include global/php.conf;
+
+    location / {
+        # This is cool because no php is touched for static content.
+        # include the "$is_args$args" so non-default permalinks doesn't break when using query string
+        try_files $uri $uri/ /index.php?q=$uri&$args;
+    }
+    
+    #location /filtron {
+    #    root /var/www/vhosts/solusar.de/subdomains/monitor/;
+    #    index index.html;
+    #}
+
+    #location ~ \.php$ {
+    #    try_files $uri =404;
+    #    fastcgi_split_path_info ^(.+\.php)(/.+)$;
+    #    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+    #    fastcgi_index index.php;
+    #    include fastcgi_params;
+    #}
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
+        expires max;
+        log_not_found off;
+    }
+
+}