update

7 files changed, 92 insertions, 57 deletions

diff --git a/terminaldweller.com/browsh/docker-compose.yaml b/terminaldweller.com/browsh/docker-compose.yaml
new file mode 100644
index 0000000..4778988
--- /dev/null
+++ b/terminaldweller.com/browsh/docker-compose.yaml
@@ -0,0 +1,13 @@
+version: "3"
+services:
+  browsh:
+    image: browsh/browsh:v1.8.0
+    networks:
+      - browshnet
+    ports:
+      - "4333:4333"
+    restart: unless-stopped
+    entrypoint: "/app/bin/browsh"
+    command: ["--http-server-mode"]
+networks:
+  browshnet:
diff --git a/terminaldweller.com/cargo/docker-compose.yaml b/terminaldweller.com/cargo/docker-compose.yaml
index ef2e1b8..7cbb5d9 100644
--- a/terminaldweller.com/cargo/docker-compose.yaml
+++ b/terminaldweller.com/cargo/docker-compose.yaml
@@ -12,7 +12,12 @@ services:
     volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf:ro
       - /home/ubuntu/cargo:/cargo
+      - /etc/letsencrypt/archive/cargo.terminaldweller.com/:/certs/
     cap_drop:
       - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
 networks:
   cargonet:
diff --git a/terminaldweller.com/cargo/nginx.conf b/terminaldweller.com/cargo/nginx.conf
index 118825c..eafeeee 100644
--- a/terminaldweller.com/cargo/nginx.conf
+++ b/terminaldweller.com/cargo/nginx.conf
@@ -3,10 +3,10 @@ events {
 }
 http {
   server {
-    listen 8080 ssl;
+    listen 8080 ssl http2;
     keepalive_timeout 70;
-    ssl_certificate /certs/server.cert;
-    ssl_certificate_key /certs/server.key;
+    ssl_certificate /certs/cert1.pem;
+    ssl_certificate_key /certs/privkey1.pem;
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers HIGH:!aNULL:!MD5;
     sendfile on;
diff --git a/terminaldweller.com/cgit/cgit.conf b/terminaldweller.com/cgit/cgit.conf
index caf8876..e180158 100644
--- a/terminaldweller.com/cgit/cgit.conf
+++ b/terminaldweller.com/cgit/cgit.conf
@@ -2,7 +2,8 @@ server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl" )
 
 $SERVER["socket"] == ":443" {
     ssl.engine                    = "enable"
-    ssl.pemfile                   = "/etc/certs/git.pem"
+    ssl.pemfile                   = "/etc/certs/fullchain1.pem"
+    ssl.privkey                   = "/etc/certs/privkey1.pem"
 
     server.name          = "git.terminaldweller.com"
     server.document-root = "/usr/share/webapps/cgit/"
diff --git a/terminaldweller.com/ejabberd/docker-compose.yaml b/terminaldweller.com/ejabberd/docker-compose.yaml
index 81c4c8d..1ca57b2 100644
--- a/terminaldweller.com/ejabberd/docker-compose.yaml
+++ b/terminaldweller.com/ejabberd/docker-compose.yaml
@@ -16,14 +16,14 @@ services:
     restart: unless-stopped
     volumes:
       - ./ejabberd.yml:/home/ejabberd/conf/ejabberd.yml
-      - /etc/letsencrypt/archive/chat.terminaldweller.com/:/opt/ejabberd/certs/
+      - /etc/letsencrypt/archive/jabber.terminaldweller.com/:/opt/ejabberd/certs/
       - ./dh:/usr/local/etc/ejabberd/dh
       - ./acme:/usr/local/etc/self_signed/
       - confs_certs:/home/ejabberd/conf/
       - mnesia_db:/home/ejabberd/database/
       - vault:/var/lib/ejabberd/
     environment:
-      - XMPP_DOMAIN=chat.terminaldweller.com
+      - XMPP_DOMAIN=jabber.terminaldweller.com
       - ERLANG_NODE=ejabberd
     #entrypoint: ["tail", "-f", "/dev/null"]
 networks:
diff --git a/terminaldweller.com/ejabberd/ejabberd.yml b/terminaldweller.com/ejabberd/ejabberd.yml
index 86d9857..228ac6d 100644
--- a/terminaldweller.com/ejabberd/ejabberd.yml
+++ b/terminaldweller.com/ejabberd/ejabberd.yml
@@ -1,5 +1,5 @@
 hosts:
-  - chat.terminaldweller.com
+  - jabber.terminaldweller.com
 
 auth_method: internal 
 auth_password_format: scram # pragma: allowlist secret
@@ -10,8 +10,8 @@ log_rotate_size: 10485760
 log_rotate_count: 1
 
 define_macro:
- 'TLS_CIPHERS': "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA"
- 'TLS_OPTIONS':
+  'TLS_CIPHERS': "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA"
+  'TLS_OPTIONS':
     - "no_sslv2"
     - "no_sslv3"
     - "no_tlsv1"
@@ -19,17 +19,17 @@ define_macro:
     - "cipher_server_preference"
     - "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA"
     - "no_compression"
- 'DH_FILE': "/usr/local/etc/ejabberd/dh/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 4096
+  'DH_FILE': "/usr/local/etc/ejabberd/dh/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 4096
 
-#c2s_dhfile: 'DH_FILE'
-#s2s_dhfile: 'DH_FILE'
+c2s_dhfile: 'DH_FILE'
+s2s_dhfile: 'DH_FILE'
 c2s_ciphers: 'TLS_CIPHERS'
 s2s_ciphers: 'TLS_CIPHERS'
 c2s_protocol_options: 'TLS_OPTIONS'
 s2s_protocol_options: 'TLS_OPTIONS'
 certfiles:
   # - /usr/local/etc/self_signed/ej2.pem
-  - /opt/ejabberd/certs/ejabberd.pem
+  - /opt/ejabberd/certs/ejabberd.pem # cat privkey1.pem fullchain1.pem > ejabberd.pem
   #- '/var/lib/ejabberd/acme/fullchain1.pem'
   #- '/var/lib/ejabberd/acme/chain1.pem'
   #- '/var/lib/ejabberd/acme/cert1.pem'
@@ -119,7 +119,7 @@ acl:
       - ::FFFF:127.0.0.1/128
   admin:
     user:
-      - 'admin@chat.terminaldweller.com'
+      - 'admin@jabber.terminaldweller.com'
 
 access_rules:
   local:
diff --git a/terminaldweller.com/haproxy/haproxy.cfg b/terminaldweller.com/haproxy/haproxy.cfg
index b659cb3..26e90f2 100644
--- a/terminaldweller.com/haproxy/haproxy.cfg
+++ b/terminaldweller.com/haproxy/haproxy.cfg
@@ -36,7 +36,7 @@ frontend http
   acl blog-host hdr_sub(host) -i blog.terminaldweller.com
   acl mail-host hdr_sub(host) -i mail.terminaldweller.com
   acl api-host hdr_sub(host) -i api.terminaldweller.com
-  acl chat-host hdr_sub(host) -i chat.terminaldweller.com
+  acl jabber-host hdr_sub(host) -i jabber.terminaldweller.com
   acl searx-host hdr_sub(host) -i searx.terminaldweller.com
   acl editor-host hdr_sub(host) -i editor.terminaldweller.com
   acl editorsave-host hdr_sub(host) -i editorsave.terminaldweller.com
@@ -44,6 +44,8 @@ frontend http
   acl discord-host hdr_sub(host) -i discord.terminaldweller.com
   acl rssgen-host hdr_sub(host) -i rssgen.terminaldweller.com
   acl git-host hdr_sub(host) -i git.terminaldweller.com
+  acl cargo-host hdr_sub(host) -i cargo.terminaldweller.com
+  acl browsh-host hdr_sub(host) -i browsh.terminaldweller.com
   acl mila-api-acl url_beg /mila
   acl crypto-api-acl url_beg /crypto
   acl http ssl_fc,not
@@ -59,27 +61,31 @@ frontend http
   http-request redirect scheme https code 301 if http searx-host !letsencrypt-acl
   http-request redirect scheme https code 301 if http git-host !letsencrypt-acl
   # http-request redirect scheme https code 301 if http rssgen-host !letsencrypt-acl
+  http-request redirect scheme https code 301 if http cargo-host !letsencrypt-acl
+  #http-request redirect scheme https code 301 if http jabber-host !letsencrypt-acl
+  # http-request redirect scheme https code 301 if http rssgen-host !letsencrypt-acl
 
   #Conditions
-  #use_backend chat-cert-backend if letsencrypt-acl chat-host
   use_backend blog-backend-cert if letsencrypt-acl blog-host
   use_backend blog-backend-cert if letsencrypt-acl editor-host
   use_backend blog-backend-cert if letsencrypt-acl editorsave-host
   use_backend cloud-one-cert if letsencrypt-acl devourer-host
-  use_backend cloud-one-cert if letsencrypt-acl chat-host
+  use_backend searx-backend-cert if letsencrypt-acl jabber-host
   use_backend api-crypto-backend-cert if letsencrypt-acl api-host
   use_backend api-mila-backend-cert if letsencrypt-acl api-host
   use_backend searx-backend-cert if letsencrypt-acl searx-host
   use_backend searx-backend-cert if letsencrypt-acl rssgen-host
   use_backend searx-backend-cert if letsencrypt-acl git-host
+  use_backend searx-backend-cert if letsencrypt-acl cargo-host
 #  use_backend editor-backend-cert if letsencrypt-acl editor-host
-  use_backend certbot-backend if letsencrypt-acl !chat-host !blog-host !api-host
+  use_backend certbot-backend if letsencrypt-acl !jabber-host !blog-host !api-host
   use_backend blog-backend if blog-host
   use_backend mail-backend if mail-host
   use_backend api-backend if api-host
   use_backend searx-backend if searx-host
-  use_backend rssgen-backend if rssgen-host
   use_backend git-backend if git-host
+  use_backend rssgen-backend if rssgen-host
+  use_backend browsh-backend if browsh-host
   #use_backend chat-backend if chat-host
   default_backend blog-backend
 
@@ -92,7 +98,7 @@ frontend https
   tcp-request content reject
   #ACLs
   acl mail-host-s req.ssl_sni -i mail.terminaldweller.com
-  acl chat-host-s req.ssl_sni -i chat.terminaldweller.com
+  acl jabber-host-s req.ssl_sni -i jabber.terminaldweller.com
   acl blog-host-s req.ssl_sni -i blog.terminaldweller.com
   acl jericho-host-s req.ssl_sni -i jericho.terminaldweller.com
   acl api-host-s req.ssl_sni -i api.terminaldweller.com
@@ -103,6 +109,7 @@ frontend https
   acl editor-host-s req.ssl_sni -i editor.terminaldweller.com
   acl editorsave-host-s req.ssl_sni -i editorsave.terminaldweller.com
   acl discord-host-s req.ssl_sni -i discord.terminaldweller.com
+  acl rssgen-host-s req.ssl_sni -i rssgen.terminaldweller.com
   #Conditions
   use_backend mail-backend-s if mail-host-s
   #use_backend chat-backend-s if chat-host-s
@@ -116,6 +123,7 @@ frontend https
   use_backend editor-backend-s if editor-host-s
   use_backend editorsave-backend-s if editorsave-host-s
   use_backend git-backend-s if git-host-s
+  use_backend rssgen-backend-s if rssgen-host-s
 
 #frontend jabber5222
 #  bind *:5222
@@ -134,8 +142,11 @@ frontend jabbber5222
   bind *:5222
   timeout client 60s
   mode tcp
-  acl chat-host req.ssl_sni -i chat.terminaldweller.com
-  use_backend chat-backend-c2s if chat-host
+  #tcp-request inspect-delay 5s
+  #tcp-request content accept if { req.ssl_hello_type 1 }
+  #tcp-request content reject
+  acl jabber-host req.ssl_sni -i jabber.terminaldweller.com
+  use_backend jabber-backend-c2s if jabber-host
 frontend jabber5223
   bind *:5223
   timeout client 60s
@@ -143,13 +154,17 @@ frontend jabber5223
   tcp-request inspect-delay 5s
   tcp-request content accept if { req.ssl_hello_type 1 }
   tcp-request content reject
-  acl chat-host-s req.ssl_sni -i chat.terminaldweller.com
-  use_backend chat-auth-backend-s if chat-host-s
+  acl jabber-host-s req.ssl_sni -i jabber.terminaldweller.com
+  use_backend jabber-auth-backend-s if jabber-host-s
 frontend jabber5280
   bind *:5280
-  mode http
-  acl chat-host hdr_sub(host) -i chat.terminaldweller.com
-  use_backend chat-backend-admin if chat-host
+  timeout client 60s
+  mode tcp
+  tcp-request inspect-delay 5s
+  tcp-request content accept if { req.ssl_hello_type 1 }
+  tcp-request content reject
+  acl jabber-host req.ssl_sni -i jabber.terminaldweller.com
+  use_backend jabber-backend-admin if jabber-host
 frontend jabber5443
   bind *:5443
   timeout client 60s
@@ -157,8 +172,8 @@ frontend jabber5443
   tcp-request inspect-delay 5s
   tcp-request content accept if { req.ssl_hello_type 1 }
   tcp-request content reject
-  acl chat-host-s req.ssl_sni -i chat.terminaldweller.com
-  use_backend chat-backend-s if chat-host-s
+  acl jabber-host-s req.ssl_sni -i jabber.terminaldweller.com
+  use_backend jabber-backend-s if jabber-host-s
 
 frontend mail-imap
   bind *:143
@@ -234,7 +249,7 @@ backend blog-backend-cert
 backend cloud-one-cert
   mode http
   option forwardfor
-  server cloud-one-host 130.185.121.80:80
+  server cloud-one-host 185.130.47.208:80
 backend blog-backend-s
   mode tcp
   option tcp-check
@@ -296,72 +311,73 @@ backend api-crypto-backend-cert
 backend api-mila-backend-s
   mode tcp
   option tcp-check
-  server api-mila-host 130.185.121.80:19019
+  server api-mila-host 185.130.47.208:9009
 backend api-mila-backend-cert
   mode http
   option forwardfor
-  server api-mila-host 130.185.121.80
+  server api-mila-host 185.130.47.208:80
 
-backend chat-backend-admin
-  mode http
-  server chat-host 130.185.121.80:5280
-#backend chat-backend
-#  mode http
-#  server chat-host 130.185.121.80:5222
-backend chat-backend-s
+backend jabber-backend-admin
   mode tcp
   option tcp-check
-  server chat-host 130.185.121.80:5443
-backend chat-backend-c2s
+  server jabber-host 185.130.47.208:5280
+backend jabber-backend-s
   mode tcp
   option tcp-check
-  server chat-host 130.185.121.80:5222
-backend chat-auth-backend-s
+  server jabber-host 185.130.47.208:5443
+backend jabber-backend-c2s
+  mode tcp
+  server jabber-host 185.130.47.208:5222
+backend jabber-auth-backend-s
   mode tcp
   option tcp-check
-  server chat-host 130.185.121.80:5223
-#backend chat-cert-backend
-#  mode http
-#  server chat-cert-server 130.185.121.80:8880
+  server jabber-host 185.130.47.208:5223
 
 backend searx-backend-cert
   mode http
-  server searx-host-cert 130.185.121.80:80
+  server searx-host-cert 185.130.47.208:80
 backend searx-backend
   mode http
-  server searx-host 130.185.121.80:8080
+  server searx-host 185.130.47.208:8080
 backend searx-backend-s
   #balance roundrobin
   mode tcp
   option tcp-check
-  server searx-host-s 130.185.121.80:8081 maxconn 10
+  server searx-host-s 185.130.47.208:8081 maxconn 10
   #server searx-host-s 192.99.102.52:8081 maxconn 10
 
 backend cargo-backend-s
   mode tcp
   option tcp-check
-  server cargo-host-s 130.185.121.80:7777
+  server cargo-host-s 185.130.47.208:7777
 
 backend editor-backend-s
   mode tcp
   option tcp-check
-  server cargo-host-s 192.99.102.52:7080
+  server editor-host-s 192.99.102.52:7080
 
 backend editorsave-backend-s
   mode tcp
   option tcp-check
-  server cargo-host-s 192.99.102.52:9080
+  server editorsave-host-s 192.99.102.52:9080
 
 backend rssgen-backend
   mode http
-  option forwardfor
-  server rssgen-host 130.185.121.80:3000 check
+  server rssgen-host-s 185.130.47.208:3000
+backend rssgen-backend-s
+  mode tcp
+  option tcp-check
+  server rssgen-host-s 185.130.47.208:3000
 
 backend git-backend
   mode http
   option forwardfor
-  server git-host 130.185.121.80:8042
+  server git-host 185.130.47.208:8042
 backend git-backend-s
   mode tcp
   option tcp-check
-  server git-host-s 130.185.121.80:8043 check
+  server git-host-s 185.130.47.208:8043 check
+
+backend browsh-backend
+  mode http
+  server browsh-host 185.130.45.46:4333