diff --git a/make/nginx.mk b/make/nginx.mk
index e20820d..b8b558a 100644
--- a/make/nginx.mk
+++ b/make/nginx.mk
@@ -2,6 +2,13 @@ installed_nginx_sites = $(wildcard /etc/nginx/http.d/*.joeac.net.conf)
 installed_nginx_subdomains = $(installed_nginx_sites:/etc/nginx/http.d/%.joeac.net.conf=%)
 nginx_subdomains_to_remove = $(filter-out $(NGINX_SUBDOMAINS),$(installed_nginx_subdomains))
 nginx_sites_to_remove = $(nginx_subdomains_to_remove:%=/etc/nginx/http.d/%.joeac.net.conf)
+nginx_module_config_template = \
+	$(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \
+	$(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template)
+nginx_module_config_template_args = \
+	DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \
+	$(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \
+	$(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))")
 
 define install_nginx_module_rule =
 .PHONY: install_nginx_$(module)
@@ -24,14 +31,17 @@ remove_$(site):
 	rm -f $(site)
 endef
 
-$(foreach module,$(MODULES),$(eval $(install_nginx_module_rule)))
-$(foreach module,$(MODULES),$(eval $(reinstall_nginx_module_rule)))
-$(foreach module,$(MODULES),$(eval $(uninstall_nginx_module_rule)))
-$(foreach site,$(nginx_sites_to_remove),$(eval $(remove_nginx_site_rule)))
-
-/etc/nginx/http.d/%.joeac.net.conf: nginx/http.d/%.joeac.net.conf /etc/nginx/http.d /etc/nginx/nginx.conf
-	sudo cp $< $@
+define nginx_module_config_rule =
+/etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf: $(nginx_module_config_template) /etc/nginx/http.d /etc/nginx/nginx.conf
+	sudo $(nginx_module_config_template_args) envsubst -i $$< -o $$@
 	sudo rc-service nginx restart
+endef
+
+$(foreach module,$(ALL_MODULES),$(eval $(install_nginx_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(reinstall_nginx_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(uninstall_nginx_module_rule)))
+$(foreach site,$(nginx_sites_to_remove),$(eval $(remove_nginx_site_rule)))
+$(foreach module,$(ALL_NGINX_MODULES),$(eval $(nginx_module_config_rule)))
 
 /etc/nginx/http.d:
 	sudo mkdir -p /etc/nginx/http.d
@@ -41,7 +51,7 @@ remove_/etc/nginx/http.d/%.joeac.net.conf:
 	rm -f $(@:remove_%=%)
 
 .PHONY: install_nginx
-install_nginx: /etc/nginx/nginx.conf $(add_prefix install_nginx_,$(NGINX_MODULES))
+install_nginx: /etc/nginx/nginx.conf $(addprefix install_nginx_,$(NGINX_MODULES))
 
 .PHONY: reinstall_nginx
 reinstall_nginx: /etc/nginx/nginx.conf $(add_prefix reinstall_nginx_,$(NGINX_MODULES)) $(addprefix remove_,$(nginx_sites_to_remove))
diff --git a/make/vars.mk b/make/vars.mk
index bcbc13f..1fb81c3 100644
--- a/make/vars.mk
+++ b/make/vars.mk
@@ -3,12 +3,13 @@ capitalise = $(shell _v="$(1)"; echo $${_v^^})
 HOSTNAME := $(shell cat /etc/hostname)
 HOSTNAMES := pi-broughton blade-canongate
 MASTER_NODE := pi-broughton
+IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME))
 MODULES_pi-broughton := http gemini smtp vaultwarden ln
 MODULES_blade-canongate := etherpad
+ALL_NGINX_MODULES := http vaultwarden ln etherpad
+NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_NGINX_MODULES))
 MODULES := $(MODULES_$(HOSTNAME))
 ALL_MODULES := $(sort $(foreach hostname,$(HOSTNAMES),$(MODULES_$(hostname))))
-IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME))
-NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_MODULES))
 COMPOSE_SERVICES := $(shell podman-compose config \
 	| yq ".services | keys" --output-format csv --csv-separator " ")
 MAKE_MODULES := $(foreach module,$(MODULES),\
@@ -29,6 +30,8 @@ PUBLIC_ROOT_DIR_ln := /var/ln.joeac.net/public
 
 $(foreach module,$(ALL_MODULES),$(if $(PORT_$(module)),$(eval \
 	export $(call capitalise,$(module))_PORT := $(PORT_$(module)))))
+$(foreach hostname,$(HOSTNAMES),$(foreach module,$(MODULES_$(hostname)),$(eval \
+	export HOST_$(module) := $(hostname:$(HOSTNAME)=localhost))))
 
 SUBDOMAINS := $(foreach module,$(MODULES),$(SUBDOMAIN_$(module)))
 NGINX_SUBDOMAINS := $(foreach module,$(NGINX_MODULES),$(SUBDOMAIN_$(module)))
@@ -40,3 +43,10 @@ PUSH_RULES := $(foreach module,$(filter $(COMPOSE_SERVICES),$(MODULES)),push_$(m
 INSTALL_RULES := $(foreach module,$(MODULES),install_$(module))
 REINSTALL_RULES := $(foreach module,$(MODULES),reinstall_$(module))
 UNINSTALL_RULES := $(foreach module,$(MODULES),uninstall_$(module))
+
+$(foreach module,$(ALL_NGINX_MODULES), \
+	$(if $(SUBDOMAIN_$(module)),, \
+		$(error $(module) is declared as an nginx module, but SUBDOMAIN_$(module) is not set)))
+$(foreach module,$(ALL_NGINX_MODULES), \
+	$(if $(PORT_$(module)) $(HOST_$(module)),,$(if $(PUBLIC_ROOT_DIR_$(module)),, \
+		$(error $(module) is declared as an nginx module, but neither PUBLIC_ROOT_DIR_$(module), nor both PORT_$(module) and HOST_$(module), are set))))
diff --git a/nginx/http.d/@.joeac.net.conf b/nginx/http.d/@.joeac.net.conf
deleted file mode 100644
index 24b31fb..0000000
--- a/nginx/http.d/@.joeac.net.conf
+++ /dev/null
@@ -1,27 +0,0 @@
-server {
-    server_name joeac.net;
-
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-    }
-
-    listen [::]:443 ssl ipv6only=on; # managed by Certbot
-    listen 443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/joeac.net-0001/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/joeac.net-0001/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-}
-
-server {
-    if ($host = joeac.net) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-
-    listen 80 default_server;
-    listen [::]:80 default_server;
-
-    server_name joeac.net;
-    return 404; # managed by Certbot
-}
diff --git a/nginx/http.d/docs.joeac.net.conf b/nginx/http.d/docs.joeac.net.conf
deleted file mode 100644
index 6b4779a..0000000
--- a/nginx/http.d/docs.joeac.net.conf
+++ /dev/null
@@ -1,26 +0,0 @@
-server {
-    server_name docs.joeac.net;
-
-    location / {
-        proxy_pass http://localhost:9001;
-    }
-
-
-    listen 443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/docs.joeac.net/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/docs.joeac.net/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-
-}
-
-server {
-    if ($host = docs.joeac.net) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-
-    server_name docs.joeac.net;
-    listen 80;
-    return 404; # managed by Certbot
-}
diff --git a/nginx/http.d/ln.joeac.net.conf b/nginx/http.d/ln.joeac.net.conf
deleted file mode 100644
index 5e21c32..0000000
--- a/nginx/http.d/ln.joeac.net.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-server {
-    server_name ln.joeac.net;
-
-    location / {
-        root /var/ln.joeac.net/public;
-        try_files $uri $uri.html $uri/index.html =404;
-        error_page 404 /index.html;
-    }
-
-    listen 443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/ln.joeac.net/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/ln.joeac.net/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-}
-
-server {
-    if ($host = ln.joeac.net) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-    server_name ln.joeac.net;
-    listen 80;
-    return 404; # managed by Certbot
-}
diff --git a/nginx/http.d/pwd.joeac.net.conf b/nginx/http.d/pwd.joeac.net.conf
deleted file mode 100644
index 0808f09..0000000
--- a/nginx/http.d/pwd.joeac.net.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-server {
-    server_name pwd.joeac.net;
-
-    location / {
-        proxy_pass http://localhost:9000;
-    }
-
-    listen 443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/pwd.joeac.net/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/pwd.joeac.net/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-}
-
-server {
-    if ($host = pwd.joeac.net) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-    server_name pwd.joeac.net;
-    listen 80;
-    return 404; # managed by Certbot
-}
diff --git a/nginx/http.d/reverse_proxy.conf.template b/nginx/http.d/reverse_proxy.conf.template
new file mode 100644
index 0000000..dc85cef
--- /dev/null
+++ b/nginx/http.d/reverse_proxy.conf.template
@@ -0,0 +1,20 @@
+server {
+    server_name ${DOMAIN};
+    location / {
+        proxy_pass http://${HOST}:${PORT};
+    }
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+server {
+    if ($$host = ${DOMAIN}) {
+        return 301 https://$$host$$request_uri;
+    }
+    server_name ${DOMAIN};
+    listen 80;
+    return 404;
+}
diff --git a/nginx/http.d/static.conf.template b/nginx/http.d/static.conf.template
new file mode 100644
index 0000000..faf5874
--- /dev/null
+++ b/nginx/http.d/static.conf.template
@@ -0,0 +1,22 @@
+server {
+    server_name ${DOMAIN};
+    location / {
+        root ${ROOT};
+        try_files $uri $uri.html $uri/index.html =404;
+        error_page 404 /index.html;
+    }
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+server {
+    if ($$host = ${DOMAIN}) {
+        return 301 https://$$host$$request_uri;
+    } # managed by Certbot
+    server_name ln.joeac.net;
+    listen 80;
+    return 404; # managed by Certbot
+}