--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/host/startup/nginx/9990-luanhost_controller.conf.luan	Wed Jan 21 21:57:07 2026 -0800
@@ -0,0 +1,34 @@
+local luanhostDir = ...
+
+%>
+	# IMPORTANT:
+	# directives outside `server` blocks are applied directly to the
+	# `http` block that this file is `include`d in. all these directives
+	# will apply to luanhost *AND* everything `include`d after it.
+	# this file name is preceded with `9990` so the glob expansion
+	# loads it towards the end of the list.
+
+	proxy_cache_path /usr/local/nginx_cache levels=1:2 keys_zone=nginx_cache:60m max_size=10g inactive=60m use_temp_path=off;
+	error_log <%=luanhostDir%>/logs/nginx_error.log warn;
+
+	server {
+		# ensure no other default_server exists!
+		# nginx usually has one at /etc/nginx/sites-enabled/default
+		listen 80 default_server;
+		listen [::]:80 default_server;
+		# DON'T put this in the auto-loaded configs dir,
+		# it is not meant to be loaded on its own.
+		include <%=luanhostDir%>/local/luanhost_default_site.conf;
+
+		location /.well-known/acme-challenge/ {
+			# $host/ssl does not exist for non-ssl sites and requests to here
+			# will fail with 404 for those sites, which is what we want
+			alias <%=luanhostDir%>/sites/$host/ssl/acme-challenge/;
+			try_files $uri $uri/ =404;
+		}
+	}
+
+	# glob pattern returns no results for site dirs that don't have 
+	# the ssl/ subdir, so this is ok
+	include <%=luanhostDir%>/sites/*/ssl/nginx.ssl.conf;
+<%