--- a/host/startup/nginx/nginx.conf.luan	Thu Dec 11 13:17:11 2025 -0700
+++ b/host/startup/nginx/nginx.conf.luan	Wed Jan 07 14:00:43 2026 -0700
@@ -1,12 +1,12 @@
 local rootDir, user, group = ...
 
 %>
-worker_processes  4;
+worker_processes	4;
 user <%=user%> <%=group%>;
-pid <%=rootDir%>/local/nginx.pid;
+pid /var/run/luanhost_nginx.pid;
 
 events {
-	worker_connections  4096;
+	worker_connections	4096;
 }
 
 http { 
@@ -25,9 +25,17 @@
 		listen 80 default_server;
 		listen [::]:80 default_server;
 		include nginx.default.conf;
+
+		location /.well-known/acme-challenge/ {
+			# $host/ssl does not exist for non-ssl sites and requests to here
+			# will fail with 404 for those sites, which is what we want
+			alias <%=rootDir%>/sites/$host/ssl/acme-challenge/;
+			autoindex on;
+		}
 	}
 
-	include <%=rootDir%>/sites/*/nginx.ssl.conf;
-	include /tmp/acme_setup/*/nginx.acme_setup.conf;
+	# glob pattern returns no results for site dirs that don't have 
+	# the ssl/ subdir, so this is ok
+	include <%=rootDir%>/sites/*/ssl/nginx.ssl.conf;
 }
 <%