This reverts commit 6e2443d5.

For proxying Kodi.

The Transmission client expect basic authentication, Vouch can't be used
for that.

Proxy the Transmission webui, require authentication.

This reverts commit c2640da8.

Until I have authentation sorted.

If the acme challenge is in a location block but the default redirection
is not, the default always takes precedence (Nginx won't resolve the
order between the different directives, but it will between different
location blocks).

Snippet to redirect to https if Upgrade-Insecure-Requests is set in the
request.

How can I miss the opportunity to interfere with Google in any way?

Login every 4 hours isn't reasonable. A week seems better to me.

Mainly ChaCha20. Also disable AESCCM (as per
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
it's slow and uncommon).

Vouch uses the Host header for calculating the JWT but we can't override
that (proxying won't work with an incorrect header). So instead it to
each deployment so we don't have multiple proxies and can override the
Host header.

Using vouch.shore.co.il.

Use the CA certificate bundle and set the verification depth (for
intermediate certificates). Right now for Vouch.

Needed for the default (fallback) acme challenge access (with the
renew-certs playbooks from the homelab repo).

To have a common .gitlab-ci.yml.

The Docker resolver replies with a TTL of 600, too long. Refresh after
30 seconds.

By default the cerificate is valid for 30 days, reasonable. Also, using
-batch means the default values are used and the certificate is
generated without any input required.