diff --git a/conf.d/00-maps.conf.template b/conf.d/00-request-maps.conf.template
similarity index 93%
rename from conf.d/00-maps.conf.template
rename to conf.d/00-request-maps.conf.template
index a26fa3b..d31b437 100644
--- a/conf.d/00-maps.conf.template
+++ b/conf.d/00-request-maps.conf.template
@@ -1,5 +1,6 @@
 map_hash_bucket_size 128;
 
+# Normalize the Connection header for WebSocket upgrades.
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;
diff --git a/conf.d/10-default.conf.template b/conf.d/10-defaults.conf.template
similarity index 60%
rename from conf.d/10-default.conf.template
rename to conf.d/10-defaults.conf.template
index 72f7d7f..03b0230 100644
--- a/conf.d/10-default.conf.template
+++ b/conf.d/10-defaults.conf.template
@@ -1,3 +1,8 @@
+http2 on;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
@@ -9,9 +14,6 @@ server {
 server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
-    include snippets/https.conf;
 
-    server_name _;
-
-    return 404;
+    ssl_reject_handshake on;
 }
diff --git a/conf.d/adguardhome.conf.template b/conf.d/adguardhome.conf.template
index ce99cad..fa28f27 100644
--- a/conf.d/adguardhome.conf.template
+++ b/conf.d/adguardhome.conf.template
@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name adguard.${BASE_DOMAIN};
 
diff --git a/conf.d/backrest.conf.template b/conf.d/backrest.conf.template
index 3b1bd7c..5e605ea 100644
--- a/conf.d/backrest.conf.template
+++ b/conf.d/backrest.conf.template
@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name backrest.${BASE_DOMAIN};
 
diff --git a/conf.d/gitea.conf.template b/conf.d/gitea.conf.template
index c231e5a..45cf26b 100644
--- a/conf.d/gitea.conf.template
+++ b/conf.d/gitea.conf.template
@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name gitea.${BASE_DOMAIN};
 
diff --git a/conf.d/homeassistant.conf.template b/conf.d/homeassistant.conf.template
index 9e21ced..d25cd0f 100644
--- a/conf.d/homeassistant.conf.template
+++ b/conf.d/homeassistant.conf.template
@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name ha.${BASE_DOMAIN};
 
diff --git a/conf.d/immich.conf.template b/conf.d/immich.conf.template
index 36befee..46a3011 100644
--- a/conf.d/immich.conf.template
+++ b/conf.d/immich.conf.template
@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name immich.${BASE_DOMAIN};
 
diff --git a/conf.d/openlist.conf.template b/conf.d/openlist.conf.template
index 83ed0d6..122f02c 100644
--- a/conf.d/openlist.conf.template
+++ b/conf.d/openlist.conf.template
@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name openlist.${BASE_DOMAIN};
 
diff --git a/conf.d/qbittorrent.conf.template b/conf.d/qbittorrent.conf.template
index 5b52f6d..fa45983 100644
--- a/conf.d/qbittorrent.conf.template
+++ b/conf.d/qbittorrent.conf.template
@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name qbt.${BASE_DOMAIN};
 
diff --git a/snippets/https.conf.template b/snippets/cert.conf.template
similarity index 92%
rename from snippets/https.conf.template
rename to snippets/cert.conf.template
index 2ce16ff..73098a5 100644
--- a/snippets/https.conf.template
+++ b/snippets/cert.conf.template
@@ -1,3 +1,2 @@
-http2 on;
 ssl_certificate /etc/nginx/certs/${BASE_DOMAIN}/fullchain.pem;
 ssl_certificate_key /etc/nginx/certs/${BASE_DOMAIN}/key.pem;
diff --git a/snippets/proxy.conf.template b/snippets/proxy.conf.template
index d4e6c5f..16057ab 100644
--- a/snippets/proxy.conf.template
+++ b/snippets/proxy.conf.template
@@ -1,19 +1,19 @@
-# restrict access
+# Allow requests only from the internal network or a trusted gateway.
 if ($allow_access = 0) {
     return 403;
 }
 
-# set headers
+# Forward normalized client metadata.
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $trusted_client_ip;
 proxy_set_header X-Forwarded-For   $trusted_client_ip;
 proxy_set_header X-Forwarded-Proto $scheme;
 
-# clean headers
-proxy_set_header X-Origin-Token    '';
-proxy_set_header EO-Connecting-IP  '';
+# Do not expose gateway authentication metadata to upstream services.
+proxy_set_header X-Origin-Token   '';
+proxy_set_header EO-Connecting-IP '';
 
-# enable websockets: http://nginx.org/en/docs/http/websocket.html
+# Support WebSocket upgrades.
 proxy_http_version 1.1;
-proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Upgrade    $http_upgrade;
 proxy_set_header Connection $connection_upgrade;