--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/host/startup/nginx/luanhost_controller.conf.luan	Wed Jan 21 20:15:11 2026 -0800
@@ -0,0 +1,25 @@
+local luanhostDir = ...
+
+%>
+	proxy_cache_path /usr/local/nginx_cache levels=1:2 keys_zone=nginx_cache:60m max_size=10g inactive=60m use_temp_path=off;
+	server {
+		# ensure no other default_server exists!
+		# nginx usually has one at /etc/nginx/sites-enabled/default
+		listen 80 default_server;
+		listen [::]:80 default_server;
+		# DON'T put this in the auto-loaded configs dir,
+		# it is not meant to be loaded on its own.
+		include <%=luanhostDir%>/local/luanhost_default_site.conf;
+
+		location /.well-known/acme-challenge/ {
+			# $host/ssl does not exist for non-ssl sites and requests to here
+			# will fail with 404 for those sites, which is what we want
+			alias <%=luanhostDir%>/sites/$host/ssl/acme-challenge/;
+			try_files $uri $uri/ =404;
+		}
+	}
+
+	# glob pattern returns no results for site dirs that don't have 
+	# the ssl/ subdir, so this is ok
+	include <%=luanhostDir%>/sites/*/ssl/nginx.ssl.conf;
+<%