diff -r 2b498e7f6d9e -r 2bc779c2451d host/gen_nginx.sh
--- a/host/gen_nginx.sh	Mon Jan 19 22:25:37 2026 -0800
+++ b/host/gen_nginx.sh	Wed Jan 21 20:15:11 2026 -0800
@@ -15,8 +15,8 @@
 
 cp startup/nginx/mime.types $NGINX_ROOT_CONFIG_DIR
 luan startup/nginx/nginx_master.conf.luan $NGINX_ROOT_CONFIG_DIR $NGINX_SITE_CONFIGS_DIR $NGINX_LOG_DIR $NGINX_PID_DIR $NGINX_USER $NGINX_GROUP >$NGINX_ROOT_CONFIG_FILE
-luan startup/nginx/nginx.conf.luan $LUANHOST_DIR >"$NGINX_SITE_CONFIGS_DIR/luanhost.conf"
+luan startup/nginx/luanhost_controller.conf.luan $LUANHOST_DIR >"$NGINX_SITE_CONFIGS_DIR/luanhost_controller.conf"
 
 # DON'T put this in the auto-loaded configs dir (NGINX_SITE_CONFIGS_DIR),
-# it is not meant to be loaded on its own.
-luan startup/nginx/nginx.default.conf.luan $LUANHOST_DIR >"$LUANHOST_DIR/local/luanhost.default.conf"
+# it is only meant to be loaded as part of a server block.
+luan startup/nginx/luanhost_default_site.conf.luan $LUANHOST_DIR >"$LUANHOST_DIR/local/luanhost_default_site.conf"

diff -r 2b498e7f6d9e -r 2bc779c2451d host/startup/nginx/luanhost_controller.conf.luan
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/host/startup/nginx/luanhost_controller.conf.luan	Wed Jan 21 20:15:11 2026 -0800
@@ -0,0 +1,25 @@
+local luanhostDir = ...
+
+%>
+	proxy_cache_path /usr/local/nginx_cache levels=1:2 keys_zone=nginx_cache:60m max_size=10g inactive=60m use_temp_path=off;
+	server {
+		# ensure no other default_server exists!
+		# nginx usually has one at /etc/nginx/sites-enabled/default
+		listen 80 default_server;
+		listen [::]:80 default_server;
+		# DON'T put this in the auto-loaded configs dir,
+		# it is not meant to be loaded on its own.
+		include <%=luanhostDir%>/local/luanhost_default_site.conf;
+
+		location /.well-known/acme-challenge/ {
+			# $host/ssl does not exist for non-ssl sites and requests to here
+			# will fail with 404 for those sites, which is what we want
+			alias <%=luanhostDir%>/sites/$host/ssl/acme-challenge/;
+			try_files $uri $uri/ =404;
+		}
+	}
+
+	# glob pattern returns no results for site dirs that don't have 
+	# the ssl/ subdir, so this is ok
+	include <%=luanhostDir%>/sites/*/ssl/nginx.ssl.conf;
+<%

diff -r 2b498e7f6d9e -r 2bc779c2451d host/startup/nginx/luanhost_default_site.conf.luan
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/host/startup/nginx/luanhost_default_site.conf.luan	Wed Jan 21 20:15:11 2026 -0800
@@ -0,0 +1,30 @@
+local luanhostDir = ...
+
+%>
+	client_max_body_size 32m;
+
+	proxy_http_version 1.1;
+	proxy_set_header Host $http_host;
+	proxy_set_header Connection '';
+
+	error_log <%=luanhostDir%>/logs/nginx_error.log;
+
+	proxy_set_header X-Forwarded-Proto $scheme;
+	proxy_set_header X-Real-IP $remote_addr;
+
+	charset utf-8;
+
+	location / {
+		chunked_transfer_encoding off;
+		proxy_cache_key $scheme$host$request_uri;
+		proxy_cache nginx_cache;
+		proxy_cache_revalidate on;
+		proxy_cache_min_uses 1;
+		proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+		proxy_cache_background_update on;
+		proxy_cache_lock on;
+		add_header X-Cache-Status $upstream_cache_status;
+		proxy_read_timeout 24h;
+		proxy_pass http://127.0.0.1:8080;
+	}
+<%

diff -r 2b498e7f6d9e -r 2bc779c2451d host/startup/nginx/nginx.conf.luan
--- a/host/startup/nginx/nginx.conf.luan	Mon Jan 19 22:25:37 2026 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,25 +0,0 @@
-local luanhostDir = ...
-
-%>
-	proxy_cache_path /usr/local/nginx_cache levels=1:2 keys_zone=nginx_cache:60m max_size=10g inactive=60m use_temp_path=off;
-	server {
-		# ensure no other default_server exists!
-		# nginx usually has one at /etc/nginx/sites-enabled/default
-		listen 80 default_server;
-		listen [::]:80 default_server;
-		# DON'T put this in the auto-loaded configs dir,
-		# it is not meant to be loaded on its own.
-		include <%=luanhostDir%>/local/luanhost.default.conf;
-
-		location /.well-known/acme-challenge/ {
-			# $host/ssl does not exist for non-ssl sites and requests to here
-			# will fail with 404 for those sites, which is what we want
-			alias <%=luanhostDir%>/sites/$host/ssl/acme-challenge/;
-			try_files $uri $uri/ =404;
-		}
-	}
-
-	# glob pattern returns no results for site dirs that don't have 
-	# the ssl/ subdir, so this is ok
-	include <%=luanhostDir%>/sites/*/ssl/nginx.ssl.conf;
-<%

diff -r 2b498e7f6d9e -r 2bc779c2451d host/startup/nginx/nginx.default.conf.luan
--- a/host/startup/nginx/nginx.default.conf.luan	Mon Jan 19 22:25:37 2026 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,30 +0,0 @@
-local luanhostDir = ...
-
-%>
-	client_max_body_size 32m;
-
-	proxy_http_version 1.1;
-	proxy_set_header Host $http_host;
-	proxy_set_header Connection '';
-
-	error_log <%=luanhostDir%>/logs/nginx_error.log;
-
-	proxy_set_header X-Forwarded-Proto $scheme;
-	proxy_set_header X-Real-IP $remote_addr;
-
-	charset utf-8;
-
-	location / {
-		chunked_transfer_encoding off;
-		proxy_cache_key $scheme$host$request_uri;
-		proxy_cache nginx_cache;
-		proxy_cache_revalidate on;
-		proxy_cache_min_uses 1;
-		proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
-		proxy_cache_background_update on;
-		proxy_cache_lock on;
-		add_header X-Cache-Status $upstream_cache_status;
-		proxy_read_timeout 24h;
-		proxy_pass http://127.0.0.1:8080;
-	}
-<%

diff -r 2b498e7f6d9e -r 2bc779c2451d src/luan/host/Https.luan
--- a/src/luan/host/Https.luan	Mon Jan 19 22:25:37 2026 -0800
+++ b/src/luan/host/Https.luan	Wed Jan 21 20:15:11 2026 -0800
@@ -102,7 +102,7 @@
 
 		ssl_certificate <%= files.local_cer_file.to_string() %>;
 		ssl_certificate_key <%= files.key_file.to_string() %>;
-		include <%=luanhost_dir.canonical().to_string()%>/local/luanhost.default.conf;
+		include <%=luanhost_dir.canonical().to_string()%>/local/luanhost_default_site.conf;
 	}
 <%
 end