diff --git a/nginx/app-shlink.stpl b/nginx/app-shlink.stpl
index c490d5c..b804d68 100755
--- a/nginx/app-shlink.stpl
+++ b/nginx/app-shlink.stpl
@@ -5,13 +5,19 @@
 #=========================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
diff --git a/nginx/arm.stpl b/nginx/arm.stpl
index 1895a12..bae34ff 100755
--- a/nginx/arm.stpl
+++ b/nginx/arm.stpl
@@ -13,13 +13,18 @@ map $http_upgrade $connection_upgrade {
   '' close;
 }
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/cloudreve.stpl b/nginx/cloudreve.stpl
index 9c1dd4c..3c2d366 100755
--- a/nginx/cloudreve.stpl
+++ b/nginx/cloudreve.stpl
@@ -5,13 +5,18 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/default.stpl b/nginx/default.stpl
index 1014ace..d7bc48e 100755
--- a/nginx/default.stpl
+++ b/nginx/default.stpl
@@ -5,7 +5,7 @@
 #=========================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
diff --git a/nginx/dns.stpl b/nginx/dns.stpl
index f24c8be..4070512 100755
--- a/nginx/dns.stpl
+++ b/nginx/dns.stpl
@@ -5,14 +5,19 @@
 #=========================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
diff --git a/nginx/dns.tpl b/nginx/dns.tpl
index 9b1b904..d657828 100755
--- a/nginx/dns.tpl
+++ b/nginx/dns.tpl
@@ -6,7 +6,6 @@
 
 server {
     listen      %ip%:%proxy_port%;
-    listen    [::]:%proxy_port%;
     server_name %domain_idn% %alias_idn%;
         
     include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
diff --git a/nginx/filerun.stpl b/nginx/filerun.stpl
index 737b7c0..d348c8d 100755
--- a/nginx/filerun.stpl
+++ b/nginx/filerun.stpl
@@ -5,13 +5,18 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    # TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/gitbucket.stpl b/nginx/gitbucket.stpl
index 1c9d0ba..03ff9f3 100755
--- a/nginx/gitbucket.stpl
+++ b/nginx/gitbucket.stpl
@@ -4,13 +4,18 @@
 #=======================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/gitea.stpl b/nginx/gitea.stpl
index 876b393..2eb337b 100755
--- a/nginx/gitea.stpl
+++ b/nginx/gitea.stpl
@@ -5,13 +5,18 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/gitlab.stpl b/nginx/gitlab.stpl
index bde844e..28d40bf 100755
--- a/nginx/gitlab.stpl
+++ b/nginx/gitlab.stpl
@@ -5,13 +5,18 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/imgjiji.stpl b/nginx/imgjiji.stpl
index afd3b8b..fa6b54b 100755
--- a/nginx/imgjiji.stpl
+++ b/nginx/imgjiji.stpl
@@ -6,13 +6,18 @@
 proxy_cache_path   /tmp/nginx-cache-jiji levels=1:2 keys_zone=r2_cache:10m max_size=10g inactive=48h use_temp_path=off;
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/kallithea.stpl b/nginx/kallithea.stpl
deleted file mode 100755
index d773f1a..0000000
--- a/nginx/kallithea.stpl
+++ /dev/null
@@ -1,45 +0,0 @@
-#=======================================================================#
-# Default Web Domain Template                                           #
-# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
-#=======================================================================#
-
-server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
-
-    include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
-
-    location / {
-        proxy_pass      http://127.0.0.1:2280;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_redirect off;
-        proxy_connect_timeout   150;
-        proxy_send_timeout      100;
-        proxy_read_timeout      100;
-        proxy_buffers           4 32k;
-        client_max_body_size    500m; # Big number is we can post big commits.
-        client_body_buffer_size 128k;
-    }
-
-    location /error/ {
-        alias   %home%/%user%/web/%domain%/document_errors/;
-    }
-
-
-    location ~ /\.ht    {return 404;}
-    location ~ /\.svn/  {return 404;}
-    location ~ /\.git/  {return 404;}
-    location ~ /\.hg/   {return 404;}
-    location ~ /\.bzr/  {return 404;}
-
-    include %home%/%user%/conf/web/%domain%/nginx.ssl.conf_*;
-}
-
diff --git a/nginx/kallithea.tpl b/nginx/kallithea.tpl
deleted file mode 100755
index 9b1b904..0000000
--- a/nginx/kallithea.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-#=========================================================================#
-# Default Web Domain Template                                             #
-# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS   #
-# https://docs.hestiacp.com/admin_docs/web.html#how-do-web-templates-work #
-#=========================================================================#
-
-server {
-    listen      %ip%:%proxy_port%;
-    listen    [::]:%proxy_port%;
-    server_name %domain_idn% %alias_idn%;
-        
-    include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
-
-    location / {
-        proxy_pass      http://%ip%:%web_port%;
-        location ~* ^.+\.(%proxy_extensions%)$ {
-            root           %docroot%;
-            access_log     /var/log/%web_system%/domains/%domain%.log combined;
-            access_log     /var/log/%web_system%/domains/%domain%.bytes bytes;
-            expires        max;
-            try_files      $uri @fallback;
-        }
-    }
-
-    location /error/ {
-        alias   %home%/%user%/web/%domain%/document_errors/;
-    }
-
-    location @fallback {
-        proxy_pass      http://%ip%:%web_port%;
-    }
-
-    location ~ /\.(?!well-known\/|file) {
-       deny all; 
-       return 404;
-    }
-
-    include %home%/%user%/conf/web/%domain%/nginx.conf_*;
-}
-
diff --git a/nginx/kuma.stpl b/nginx/kuma.stpl
index c379999..d37c4be 100755
--- a/nginx/kuma.stpl
+++ b/nginx/kuma.stpl
@@ -5,13 +5,18 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen      [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen      [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/mail.stpl b/nginx/mail.stpl
index 69d1ae8..4b1d274 100755
--- a/nginx/mail.stpl
+++ b/nginx/mail.stpl
@@ -5,14 +5,19 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen      [::]:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
diff --git a/nginx/mail.tpl b/nginx/mail.tpl
index 9b1b904..3a7fba1 100755
--- a/nginx/mail.tpl
+++ b/nginx/mail.tpl
@@ -1,18 +1,16 @@
-#=========================================================================#
-# Default Web Domain Template                                             #
-# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS   #
-# https://docs.hestiacp.com/admin_docs/web.html#how-do-web-templates-work #
-#=========================================================================#
+#=======================================================================#
+# Default Web Domain Template                                           #
+# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
+#=======================================================================#
 
 server {
     listen      %ip%:%proxy_port%;
-    listen    [::]:%proxy_port%;
     server_name %domain_idn% %alias_idn%;
         
     include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
 
     location / {
-        proxy_pass      http://%ip%:%web_port%;
+        proxy_pass      http://127.0.0.1:8010;
         location ~* ^.+\.(%proxy_extensions%)$ {
             root           %docroot%;
             access_log     /var/log/%web_system%/domains/%domain%.log combined;
@@ -30,10 +28,11 @@ server {
         proxy_pass      http://%ip%:%web_port%;
     }
 
-    location ~ /\.(?!well-known\/|file) {
-       deny all; 
-       return 404;
-    }
+    location ~ /\.ht    {return 404;}
+    location ~ /\.svn/  {return 404;}
+    location ~ /\.git/  {return 404;}
+    location ~ /\.hg/   {return 404;}
+    location ~ /\.bzr/  {return 404;}
 
     include %home%/%user%/conf/web/%domain%/nginx.conf_*;
 }
diff --git a/nginx/mastodon.stpl b/nginx/mastodon.stpl
index a47bcb9..cfabf70 100755
--- a/nginx/mastodon.stpl
+++ b/nginx/mastodon.stpl
@@ -16,13 +16,18 @@ upstream streaming {
     server 127.0.0.1:4000 fail_timeout=0;
 }
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/matrix.stpl b/nginx/matrix.stpl
index 2498863..0ad5fc5 100755
--- a/nginx/matrix.stpl
+++ b/nginx/matrix.stpl
@@ -5,15 +5,19 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
-    listen 8448 ssl default_server;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
     
@@ -25,6 +29,14 @@ server {
     gzip_min_length 256;
     gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
     gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+    location / {
+        proxy_pass http://127.0.0.1:6080;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        # Nginx by default only allows file uploads up to 1M in size
+        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+    }
+
    location /.well-known/matrix/client {
         return 200 '{"m.homeserver": {"base_url": "https://im.kernel.ws"}}';
         default_type application/json;
diff --git a/nginx/matrix.tpl b/nginx/matrix.tpl
index 393b52c..d657828 100755
--- a/nginx/matrix.tpl
+++ b/nginx/matrix.tpl
@@ -1,22 +1,19 @@
-#=======================================================================#
-# Default Web Domain Template                                           #
-# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
-#=======================================================================#
-
+#=========================================================================#
+# Default Web Domain Template                                             #
+# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS   #
+# https://docs.hestiacp.com/admin_docs/web.html#how-do-web-templates-work #
+#=========================================================================#
 
 server {
-    listen      %ip%:%proxy_port% ;
-    listen    [::]:%proxy_port%;
+    listen      %ip%:%proxy_port%;
     server_name %domain_idn% %alias_idn%;
-
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
-
-    include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
+        
+    include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
 
     location / {
-        proxy_pass      http://127.0.0.1:8010;
-        location ~* ^.+\.(%proxy_extentions%)$ {
-            root           %sdocroot%;
+        proxy_pass      http://%ip%:%web_port%;
+        location ~* ^.+\.(%proxy_extensions%)$ {
+            root           %docroot%;
             access_log     /var/log/%web_system%/domains/%domain%.log combined;
             access_log     /var/log/%web_system%/domains/%domain%.bytes bytes;
             expires        max;
@@ -29,15 +26,14 @@ server {
     }
 
     location @fallback {
-        proxy_pass      http://127.0.0.1:8010;
+        proxy_pass      http://%ip%:%web_port%;
     }
 
-    location ~ /\.ht    {return 404;}
-    location ~ /\.svn/  {return 404;}
-    location ~ /\.git/  {return 404;}
-    location ~ /\.hg/   {return 404;}
-    location ~ /\.bzr/  {return 404;}
+    location ~ /\.(?!well-known\/|file) {
+       deny all; 
+       return 404;
+    }
 
-    include %home%/%user%/conf/web/%domain%/nginx.ssl.conf_*;
+    include %home%/%user%/conf/web/%domain%/nginx.conf_*;
 }
 
diff --git a/nginx/mirrors.stpl b/nginx/mirrors.stpl
index 876a570..178da46 100755
--- a/nginx/mirrors.stpl
+++ b/nginx/mirrors.stpl
@@ -5,13 +5,18 @@
 #=========================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
    root /home/tunasync/mirrors;
diff --git a/nginx/misskey.stpl b/nginx/misskey.stpl
index e3dba59..562e17b 100755
--- a/nginx/misskey.stpl
+++ b/nginx/misskey.stpl
@@ -8,13 +8,18 @@ map $http_upgrade $connection_upgrade {
 }
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen      [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen      [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/portainer.stpl b/nginx/portainer.stpl
index fa1b15c..2250b05 100755
--- a/nginx/portainer.stpl
+++ b/nginx/portainer.stpl
@@ -12,14 +12,19 @@ map $http_upgrade $connection_upgrade {
 }
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
diff --git a/nginx/portainer.tpl b/nginx/portainer.tpl
index 9b1b904..d657828 100755
--- a/nginx/portainer.tpl
+++ b/nginx/portainer.tpl
@@ -6,7 +6,6 @@
 
 server {
     listen      %ip%:%proxy_port%;
-    listen    [::]:%proxy_port%;
     server_name %domain_idn% %alias_idn%;
         
     include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
diff --git a/nginx/s3.stpl b/nginx/s3.stpl
index 152ba2d..119fc80 100755
--- a/nginx/s3.stpl
+++ b/nginx/s3.stpl
@@ -7,13 +7,18 @@ proxy_cache_path   /tmp/nginx-cache-instance-media levels=1:2 keys_zone=s3_cache
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
diff --git a/nginx/shlink.stpl b/nginx/shlink.stpl
index 9b8829b..d1819d3 100755
--- a/nginx/shlink.stpl
+++ b/nginx/shlink.stpl
@@ -5,13 +5,19 @@
 #=========================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
diff --git a/nginx/tz.stpl b/nginx/tz.stpl
index 9eac0d2..e72fb70 100755
--- a/nginx/tz.stpl
+++ b/nginx/tz.stpl
@@ -5,8 +5,8 @@
 
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
diff --git a/nginx/ws.stpl b/nginx/ws.stpl
index c3ce23e..d9ff13e 100755
--- a/nginx/ws.stpl
+++ b/nginx/ws.stpl
@@ -4,14 +4,19 @@
 #=======================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
-    server_name %domain_idn% %alias_idn%;
-    ssl_certificate      %ssl_pem%;
-    ssl_certificate_key  %ssl_key%;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    error_log  /var/log/%web_system%/domains/%domain%.error.log error;
+	listen      %ip%:%proxy_ssl_port% ssl;
+	server_name %domain_idn% %alias_idn%;
+	error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+	ssl_certificate     %ssl_pem%;
+	ssl_certificate_key %ssl_key%;
+	ssl_stapling        on;
+	ssl_stapling_verify on;
+
+	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
 
@@ -26,7 +31,7 @@ server {
         }
     }
     
-    location /sky {
+      location /sky {
       proxy_redirect off;
       proxy_pass http://127.0.0.1:23876;
       proxy_http_version 1.1;
diff --git a/nginx/ws.tpl b/nginx/ws.tpl
index 0441295..9139d27 100755
--- a/nginx/ws.tpl
+++ b/nginx/ws.tpl
@@ -5,7 +5,6 @@
 
 server {
     listen      %ip%:%proxy_port%;
-    listen    [::]:%proxy_port%;
     server_name %domain_idn% %alias_idn%;
         
     include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
diff --git a/nginx/xray.stpl b/nginx/xray.stpl
index db53e46..2832e8d 100755
--- a/nginx/xray.stpl
+++ b/nginx/xray.stpl
@@ -4,13 +4,18 @@
 #=======================================================================#
 
 server {
-    listen      %ip%:%proxy_ssl_port% ssl http2;
-    listen    [::]:%proxy_ssl_port% ssl http2;
+    listen      %ip%:%proxy_ssl_port% ssl;
+    listen    [::]:%proxy_ssl_port% ssl;
     server_name %domain_idn% %alias_idn%;
     ssl_certificate      %ssl_pem%;
     ssl_certificate_key  %ssl_key%;
     ssl_stapling on;
     ssl_stapling_verify on;
+
+    	# TLS 1.3 0-RTT anti-replay
+	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
+	if ($anti_replay = 425) { return 425; }
+
     error_log  /var/log/%web_system%/domains/%domain%.error.log error;
 
     include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;