diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7b7d3f12..05669038 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,10 +20,6 @@ updates:
     directory: "/packages/website"
     schedule:
       interval: weekly
-  - package-ecosystem: docker
-    directory: "/docker/caddy"
-    schedule:
-      interval: weekly
   - package-ecosystem: docker
     directory: "/docker/nginx"
     schedule:
diff --git a/docker-compose.abuse-scanner.yml b/docker-compose.abuse-scanner.yml
index f655b0ea..4edb6556 100644
--- a/docker-compose.abuse-scanner.yml
+++ b/docker-compose.abuse-scanner.yml
@@ -8,6 +8,8 @@ x-logging: &default-logging
 
 services:
   abuse-scanner:
+    # uncomment "build" and comment out "image" to build from sources
+    # build: https://github.com/SkynetLabs/abuse-scanner.git#main
     image: skynetlabs/abuse-scanner
     container_name: abuse-scanner
     restart: unless-stopped
diff --git a/docker-compose.blocker.yml b/docker-compose.blocker.yml
index 3c1deeaa..edcb45c0 100644
--- a/docker-compose.blocker.yml
+++ b/docker-compose.blocker.yml
@@ -13,6 +13,8 @@ services:
       - BLOCKER_PORT=4000
 
   blocker:
+    # uncomment "build" and comment out "image" to build from sources
+    # build: https://github.com/SkynetLabs/blocker.git#main
     image: skynetlabs/blocker
     container_name: blocker
     restart: unless-stopped
diff --git a/docker-compose.malware-scanner.yml b/docker-compose.malware-scanner.yml
index 9fc68374..fba60f98 100644
--- a/docker-compose.malware-scanner.yml
+++ b/docker-compose.malware-scanner.yml
@@ -26,6 +26,8 @@ services:
         ipv4_address: 10.10.10.100
 
   malware-scanner:
+    # uncomment "build" and comment out "image" to build from sources
+    # build: https://github.com/SkynetLabs/malware-scanner.git#main
     image: skynetlabs/malware-scanner
     container_name: malware-scanner
     restart: unless-stopped
diff --git a/docker-compose.yml b/docker-compose.yml
index af9b53a2..2879b8b6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -39,21 +39,19 @@ services:
     expose:
       - 9980
 
-  caddy:
-    build:
-      context: ./docker/caddy
-      dockerfile: Dockerfile
-    container_name: caddy
+  certbot:
+    image: certbot/dns-route53:v1.25.0
+    entrypoint: sh /entrypoint.sh
+    container_name: certbot
     restart: unless-stopped
     logging: *default-logging
     env_file:
       - .env
+    environment:
+      - CERTBOT_ARGS=--dns-route53
     volumes:
-      - ./docker/data/caddy/data:/data
-      - ./docker/data/caddy/config:/config
-    networks:
-      shared:
-        ipv4_address: 10.10.10.20
+      - ./docker/certbot/entrypoint.sh:/entrypoint.sh
+      - ./docker/data/certbot:/etc/letsencrypt
 
   nginx:
     build:
@@ -70,7 +68,7 @@ services:
       - ./docker/data/nginx/logs:/usr/local/openresty/nginx/logs
       - ./docker/data/nginx/skynet:/data/nginx/skynet:ro
       - ./docker/data/sia/apipassword:/data/sia/apipassword:ro
-      - ./docker/data/caddy/data:/data/caddy:ro
+      - ./docker/data/certbot:/etc/letsencrypt
     networks:
       shared:
         ipv4_address: 10.10.10.30
@@ -79,7 +77,6 @@ services:
       - "80:80"
     depends_on:
       - sia
-      - caddy
       - handshake-api
       - dnslink-api
       - website
@@ -174,5 +171,3 @@ services:
       - STATE_DIR=/usr/app/state
     expose:
       - 3100
-    depends_on:
-      - caddy
diff --git a/docker/caddy/Dockerfile b/docker/caddy/Dockerfile
deleted file mode 100644
index 31075803..00000000
--- a/docker/caddy/Dockerfile
+++ /dev/null
@@ -1,18 +0,0 @@
-FROM caddy:2.4.6-builder AS caddy-builder
-
-# available dns resolvers: https://github.com/caddy-dns
-RUN xcaddy build --with github.com/caddy-dns/route53
-
-FROM caddy:2.4.6-alpine
-
-COPY --from=caddy-builder /usr/bin/caddy /usr/bin/caddy
-
-# bash required for mo to work (mo is mustache templating engine - https://github.com/tests-always-included/mo)
-RUN apk add --no-cache bash
-
-COPY caddy.json.template mo /etc/caddy/
-
-CMD [ "sh", "-c", \
-      "/etc/caddy/mo < /etc/caddy/caddy.json.template > /etc/caddy/caddy.json ; \
-       caddy run --config /etc/caddy/caddy.json" \
-    ]
diff --git a/docker/caddy/caddy.json.template b/docker/caddy/caddy.json.template
deleted file mode 100644
index a133f0cd..00000000
--- a/docker/caddy/caddy.json.template
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "apps": {
-    "tls": {
-      "certificates": {
-        "automate": [
-          {{#PORTAL_DOMAIN}}
-              "{{PORTAL_DOMAIN}}", "*.{{PORTAL_DOMAIN}}", "*.hns.{{PORTAL_DOMAIN}}"
-          {{/PORTAL_DOMAIN}}
-
-          {{#PORTAL_DOMAIN}}{{#SERVER_DOMAIN}},{{/SERVER_DOMAIN}}{{/PORTAL_DOMAIN}}
-
-          {{#SERVER_DOMAIN}}
-              "{{SERVER_DOMAIN}}", "*.{{SERVER_DOMAIN}}", "*.hns.{{SERVER_DOMAIN}}"
-          {{/SERVER_DOMAIN}}
-        ]
-      },
-      "automation": {
-        "policies": [
-          {
-            "issuers": [
-              {
-                "module": "acme",
-                "email": "{{EMAIL_ADDRESS}}",
-                "challenges": {
-                  "dns": {
-                    "provider": {
-                      "name": "route53"
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/docker/caddy/mo b/docker/caddy/mo
deleted file mode 100755
index ba8e48d1..00000000
--- a/docker/caddy/mo
+++ /dev/null
@@ -1,1106 +0,0 @@
-#!/usr/bin/env bash
-#
-#/ Mo is a mustache template rendering software written in bash.  It inserts
-#/ environment variables into templates.
-#/
-#/ Simply put, mo will change {{VARIABLE}} into the value of that
-#/ environment variable.  You can use {{#VARIABLE}}content{{/VARIABLE}} to
-#/ conditionally display content or iterate over the values of an array.
-#/
-#/ Learn more about mustache templates at https://mustache.github.io/
-#/
-#/ Simple usage:
-#/
-#/    mo [OPTIONS] filenames...
-#/
-#/ Options:
-#/
-#/    -u, --fail-not-set
-#/          Fail upon expansion of an unset variable.
-#/    -x, --fail-on-function
-#/          Fail when a function returns a non-zero status code.
-#/    -e, --false
-#/          Treat the string "false" as empty for conditionals.
-#/    -h, --help
-#/          This message.
-#/    -s=FILE, --source=FILE
-#/          Load FILE into the environment before processing templates.
-#/          Can be used multiple times.
-#
-# Mo is under a MIT style licence with an additional non-advertising clause.
-# See LICENSE.md for the full text.
-#
-# This is open source!  Please feel free to contribute.
-#
-# https://github.com/tests-always-included/mo
-
-
-# Public: Template parser function.  Writes templates to stdout.
-#
-# $0 - Name of the mo file, used for getting the help message.
-# $@ - Filenames to parse.
-#
-# Options:
-#
-#     --allow-function-arguments
-#
-# Permit functions in templates to be called with additional arguments.  This
-# puts template data directly in to the path of an eval statement. Use with
-# caution. Not listed in the help because it only makes sense when mo is
-# sourced.
-#
-#     -u, --fail-not-set
-#
-# Fail upon expansion of an unset variable.  Default behavior is to silently
-# ignore and expand into empty string.
-#
-#     -x, --fail-on-function
-#
-# Fail when a function used by a template returns an error status code.
-# Alternately, ou may set the MO_FAIL_ON_FUNCTION environment variable to a
-# non-empty value to enable this behavior.
-#
-#     -e, --false
-#
-# Treat "false" as an empty value.  You may set the MO_FALSE_IS_EMPTY
-# environment variable instead to a non-empty value to enable this behavior.
-#
-#     -h, --help
-#
-# Display a help message.
-#
-#     -s=FILE, --source=FILE
-#
-# Source a file into the environment before processing template files.
-# This can be used multiple times.
-#
-#     --
-#
-# Used to indicate the end of options.  You may optionally use this when
-# filenames may start with two hyphens.
-#
-# Mo uses the following environment variables:
-#
-# MO_ALLOW_FUNCTION_ARGUMENTS - When set to a non-empty value, this allows
-#                  functions referenced in templates to receive additional
-#                  options and arguments. This puts the content from the
-#                  template directly into an eval statement. Use with extreme
-#                  care.
-# MO_FUNCTION_ARGS - Arguments passed to the function
-# MO_FAIL_ON_FUNCTION - If a function returns a non-zero status code, abort
-#                  with an error.
-# MO_FAIL_ON_UNSET - When set to a non-empty value, expansion of an unset env
-#                  variable will be aborted with an error.
-# MO_FALSE_IS_EMPTY - When set to a non-empty value, the string "false" will be
-#                  treated as an empty value for the purposes of conditionals.
-# MO_ORIGINAL_COMMAND - Used to find the `mo` program in order to generate a
-#                  help message.
-#
-# Returns nothing.
-mo() (
-    # This function executes in a subshell so IFS is reset.
-    # Namespace this variable so we don't conflict with desired values.
-    local moContent f2source files doubleHyphens
-
-    IFS=$' \n\t'
-    files=()
-    doubleHyphens=false
-
-    if [[ $# -gt 0 ]]; then
-        for arg in "$@"; do
-            if $doubleHyphens; then
-                #: After we encounter two hyphens together, all the rest
-                #: of the arguments are files.
-                files=("${files[@]}" "$arg")
-            else
-                case "$arg" in
-                    -h|--h|--he|--hel|--help|-\?)
-                        moUsage "$0"
-                        exit 0
-                        ;;
-
-                    --allow-function-arguments)
-                        # shellcheck disable=SC2030
-                        MO_ALLOW_FUNCTION_ARGUMENTS=true
-                        ;;
-
-                    -u | --fail-not-set)
-                        # shellcheck disable=SC2030
-                        MO_FAIL_ON_UNSET=true
-                        ;;
-
-                    -x | --fail-on-function)
-                        # shellcheck disable=SC2030
-                        MO_FAIL_ON_FUNCTION=true
-                        ;;
-
-                    -e | --false)
-                        # shellcheck disable=SC2030
-                        MO_FALSE_IS_EMPTY=true
-                        ;;
-
-                    -s=* | --source=*)
-                        if [[ "$arg" == --source=* ]]; then
-                            f2source="${arg#--source=}"
-                        else
-                            f2source="${arg#-s=}"
-                        fi
-
-                        if [[ -f "$f2source" ]]; then
-                            # shellcheck disable=SC1090
-                            . "$f2source"
-                        else
-                            echo "No such file: $f2source" >&2
-                            exit 1
-                        fi
-                        ;;
-
-                    --)
-                        #: Set a flag indicating we've encountered double hyphens
-                        doubleHyphens=true
-                        ;;
-
-                    *)
-                        #: Every arg that is not a flag or a option should be a file
-                        files=(${files[@]+"${files[@]}"} "$arg")
-                        ;;
-                esac
-            fi
-        done
-    fi
-
-    moGetContent moContent "${files[@]}" || return 1
-    moParse "$moContent" "" true
-)
-
-
-# Internal: Call a function.
-#
-# $1 - Variable for output
-# $2 - Function to call
-# $3 - Content to pass
-# $4 - Additional arguments as a single string
-#
-# This can be dangerous, especially if you are using tags like
-# {{someFunction ; rm -rf / }}
-#
-# Returns nothing.
-moCallFunction() {
-    local moArgs moContent moFunctionArgs moFunctionResult
-
-    moArgs=()
-    moTrimWhitespace moFunctionArgs "$4"
-
-    # shellcheck disable=SC2031
-    if [[ -n "${MO_ALLOW_FUNCTION_ARGUMENTS-}" ]]; then
-        # Intentionally bad behavior
-        # shellcheck disable=SC2206
-        moArgs=($4)
-    fi
-
-    moContent=$(echo -n "$3" | MO_FUNCTION_ARGS="$moFunctionArgs" eval "$2" "${moArgs[@]}") || {
-        moFunctionResult=$?
-        # shellcheck disable=SC2031
-        if [[ -n "${MO_FAIL_ON_FUNCTION-}" && "$moFunctionResult" != 0 ]]; then
-            echo "Function '$2' with args (${moArgs[*]+"${moArgs[@]}"}) failed with status code $moFunctionResult"
-            exit "$moFunctionResult"
-        fi
-    }
-
-    # shellcheck disable=SC2031
-    local "$1" && moIndirect "$1" "$moContent"
-}
-
-
-# Internal: Scan content until the right end tag is found.  Creates an array
-# with the following members:
-#
-#   [0] = Content before end tag
-#   [1] = End tag (complete tag)
-#   [2] = Content after end tag
-#
-# Everything using this function uses the "standalone tags" logic.
-#
-# $1 - Name of variable for the array
-# $2 - Content
-# $3 - Name of end tag
-# $4 - If -z, do standalone tag processing before finishing
-#
-# Returns nothing.
-moFindEndTag() {
-    local content remaining scanned standaloneBytes tag
-
-    #: Find open tags
-    scanned=""
-    moSplit content "$2" '{{' '}}'
-
-    while [[ "${#content[@]}" -gt 1 ]]; do
-        moTrimWhitespace tag "${content[1]}"
-
-        #: Restore content[1] before we start using it
-        content[1]='{{'"${content[1]}"'}}'
-
-        case $tag in
-            '#'* | '^'*)
-                #: Start another block
-                scanned="${scanned}${content[0]}${content[1]}"
-                moTrimWhitespace tag "${tag:1}"
-                moFindEndTag content "${content[2]}" "$tag" "loop"
-                scanned="${scanned}${content[0]}${content[1]}"
-                remaining=${content[2]}
-                ;;
-
-            '/'*)
-                #: End a block - could be ours
-                moTrimWhitespace tag "${tag:1}"
-                scanned="$scanned${content[0]}"
-
-                if [[ "$tag" == "$3" ]]; then
-                    #: Found our end tag
-                    if [[ -z "${4-}" ]] && moIsStandalone standaloneBytes "$scanned" "${content[2]}" true; then
-                        #: This is also a standalone tag - clean up whitespace
-                        #: and move those whitespace bytes to the "tag" element
-                        # shellcheck disable=SC2206
-                        standaloneBytes=( $standaloneBytes )
-                        content[1]="${scanned:${standaloneBytes[0]}}${content[1]}${content[2]:0:${standaloneBytes[1]}}"
-                        scanned="${scanned:0:${standaloneBytes[0]}}"
-                        content[2]="${content[2]:${standaloneBytes[1]}}"
-                    fi
-
-                    local "$1" && moIndirectArray "$1" "$scanned" "${content[1]}" "${content[2]}"
-                    return 0
-                fi
-
-                scanned="$scanned${content[1]}"
-                remaining=${content[2]}
-                ;;
-
-            *)
-                #: Ignore all other tags
-                scanned="${scanned}${content[0]}${content[1]}"
-                remaining=${content[2]}
-                ;;
-        esac
-
-        moSplit content "$remaining" '{{' '}}'
-    done
-
-    #: Did not find our closing tag
-    scanned="$scanned${content[0]}"
-    local "$1" && moIndirectArray "$1" "${scanned}" "" ""
-}
-
-
-# Internal: Find the first index of a substring.  If not found, sets the
-# index to -1.
-#
-# $1 - Destination variable for the index
-# $2 - Haystack
-# $3 - Needle
-#
-# Returns nothing.
-moFindString() {
-    local pos string
-
-    string=${2%%$3*}
-    [[ "$string" == "$2" ]] && pos=-1 || pos=${#string}
-    local "$1" && moIndirect "$1" "$pos"
-}
-
-
-# Internal: Generate a dotted name based on current context and target name.
-#
-# $1 - Target variable to store results
-# $2 - Context name
-# $3 - Desired variable name
-#
-# Returns nothing.
-moFullTagName() {
-    if [[ -z "${2-}" ]] || [[ "$2" == *.* ]]; then
-        local "$1" && moIndirect "$1" "$3"
-    else
-        local "$1" && moIndirect "$1" "${2}.${3}"
-    fi
-}
-
-
-# Internal: Fetches the content to parse into a variable.  Can be a list of
-# partials for files or the content from stdin.
-#
-# $1   - Variable name to assign this content back as
-# $2-@ - File names (optional)
-#
-# Returns nothing.
-moGetContent() {
-    local moContent moFilename moTarget
-
-    moTarget=$1
-    shift
-    if [[ "${#@}" -gt 0 ]]; then
-        moContent=""
-
-        for moFilename in "$@"; do
-            #: This is so relative paths work from inside template files
-            moContent="$moContent"'{{>'"$moFilename"'}}'
-        done
-    else
-        moLoadFile moContent || return 1
-    fi
-
-    local "$moTarget" && moIndirect "$moTarget" "$moContent"
-}
-
-
-# Internal: Indent a string, placing the indent at the beginning of every
-# line that has any content.
-#
-# $1 - Name of destination variable to get an array of lines
-# $2 - The indent string
-# $3 - The string to reindent
-#
-# Returns nothing.
-moIndentLines() {
-    local content fragment len posN posR result trimmed
-
-    result=""
-
-    #: Remove the period from the end of the string.
-    len=$((${#3} - 1))
-    content=${3:0:$len}
-
-    if [[ -z "${2-}" ]]; then
-        local "$1" && moIndirect "$1" "$content"
-
-        return 0
-    fi
-
-    moFindString posN "$content" $'\n'
-    moFindString posR "$content" $'\r'
-
-    while [[ "$posN" -gt -1 ]] || [[ "$posR" -gt -1 ]]; do
-        if [[ "$posN" -gt -1 ]]; then
-            fragment="${content:0:$posN + 1}"
-            content=${content:$posN + 1}
-        else
-            fragment="${content:0:$posR + 1}"
-            content=${content:$posR + 1}
-        fi
-
-        moTrimChars trimmed "$fragment" false true " " $'\t' $'\n' $'\r'
-
-        if [[ -n "$trimmed" ]]; then
-            fragment="$2$fragment"
-        fi
-
-        result="$result$fragment"
-
-        moFindString posN "$content" $'\n'
-        moFindString posR "$content" $'\r'
-
-        # If the content ends in a newline, do not indent.
-        if [[ "$posN" -eq ${#content} ]]; then
-            # Special clause for \r\n
-            if [[ "$posR" -eq "$((posN - 1))" ]]; then
-                posR=-1
-            fi
-
-            posN=-1
-        fi
-
-        if [[ "$posR" -eq ${#content} ]]; then
-            posR=-1
-        fi
-    done
-
-    moTrimChars trimmed "$content" false true " " $'\t'
-
-    if [[ -n "$trimmed" ]]; then
-        content="$2$content"
-    fi
-
-    result="$result$content"
-
-    local "$1" && moIndirect "$1" "$result"
-}
-
-
-# Internal: Send a variable up to the parent of the caller of this function.
-#
-# $1 - Variable name
-# $2 - Value
-#
-# Examples
-#
-#   callFunc () {
-#       local "$1" && moIndirect "$1" "the value"
-#   }
-#   callFunc dest
-#   echo "$dest"  # writes "the value"
-#
-# Returns nothing.
-moIndirect() {
-    unset -v "$1"
-    printf -v "$1" '%s' "$2"
-}
-
-
-# Internal: Send an array as a variable up to caller of a function
-#
-# $1   - Variable name
-# $2-@ - Array elements
-#
-# Examples
-#
-#   callFunc () {
-#       local myArray=(one two three)
-#       local "$1" && moIndirectArray "$1" "${myArray[@]}"
-#   }
-#   callFunc dest
-#   echo "${dest[@]}" # writes "one two three"
-#
-# Returns nothing.
-moIndirectArray() {
-    unset -v "$1"
-
-    # IFS must be set to a string containing space or unset in order for
-    # the array slicing to work regardless of the current IFS setting on
-    # bash 3.  This is detailed further at
-    # https://github.com/fidian/gg-core/pull/7
-    eval "$(printf "IFS= %s=(\"\${@:2}\") IFS=%q" "$1" "$IFS")"
-}
-
-
-# Internal: Determine if a given environment variable exists and if it is
-# an array.
-#
-# $1 - Name of environment variable
-#
-# Be extremely careful.  Even if strict mode is enabled, it is not honored
-# in newer versions of Bash.  Any errors that crop up here will not be
-# caught automatically.
-#
-# Examples
-#
-#   var=(abc)
-#   if moIsArray var; then
-#      echo "This is an array"
-#      echo "Make sure you don't accidentally use \$var"
-#   fi
-#
-# Returns 0 if the name is not empty, 1 otherwise.
-moIsArray() {
-    # Namespace this variable so we don't conflict with what we're testing.
-    local moTestResult
-
-    moTestResult=$(declare -p "$1" 2>/dev/null) || return 1
-    [[ "${moTestResult:0:10}" == "declare -a" ]] && return 0
-    [[ "${moTestResult:0:10}" == "declare -A" ]] && return 0
-
-    return 1
-}
-
-
-# Internal: Determine if the given name is a defined function.
-#
-# $1 - Function name to check
-#
-# Be extremely careful.  Even if strict mode is enabled, it is not honored
-# in newer versions of Bash.  Any errors that crop up here will not be
-# caught automatically.
-#
-# Examples
-#
-#   moo () {
-#       echo "This is a function"
-#   }
-#   if moIsFunction moo; then
-#       echo "moo is a defined function"
-#   fi
-#
-# Returns 0 if the name is a function, 1 otherwise.
-moIsFunction() {
-    local functionList functionName
-
-    functionList=$(declare -F)
-    # shellcheck disable=SC2206
-    functionList=( ${functionList//declare -f /} )
-
-    for functionName in "${functionList[@]}"; do
-        if [[ "$functionName" == "$1" ]]; then
-            return 0
-        fi
-    done
-
-    return 1
-}
-
-
-# Internal: Determine if the tag is a standalone tag based on whitespace
-# before and after the tag.
-#
-# Passes back a string containing two numbers in the format "BEFORE AFTER"
-# like "27 10".  It indicates the number of bytes remaining in the "before"
-# string (27) and the number of bytes to trim in the "after" string (10).
-# Useful for string manipulation:
-#
-# $1 - Variable to set for passing data back
-# $2 - Content before the tag
-# $3 - Content after the tag
-# $4 - true/false: is this the beginning of the content?
-#
-# Examples
-#
-#   moIsStandalone RESULT "$before" "$after" false || return 0
-#   RESULT_ARRAY=( $RESULT )
-#   echo "${before:0:${RESULT_ARRAY[0]}}...${after:${RESULT_ARRAY[1]}}"
-#
-# Returns nothing.
-moIsStandalone() {
-    local afterTrimmed beforeTrimmed char
-
-    moTrimChars beforeTrimmed "$2" false true " " $'\t'
-    moTrimChars afterTrimmed "$3" true false " " $'\t'
-    char=$((${#beforeTrimmed} - 1))
-    char=${beforeTrimmed:$char}
-
-    # If the content before didn't end in a newline
-    if [[ "$char" != $'\n' ]] && [[ "$char" != $'\r' ]]; then
-        # and there was content or this didn't start the file
-        if [[ -n "$char" ]] || ! $4; then
-            # then this is not a standalone tag.
-            return 1
-        fi
-    fi
-
-    char=${afterTrimmed:0:1}
-
-    # If the content after doesn't start with a newline and it is something
-    if [[ "$char" != $'\n' ]] && [[ "$char" != $'\r' ]] && [[ -n "$char" ]]; then
-        # then this is not a standalone tag.
-        return 2
-    fi
-
-    if [[ "$char" == $'\r' ]] && [[ "${afterTrimmed:1:1}" == $'\n' ]]; then
-        char="$char"$'\n'
-    fi
-
-    local "$1" && moIndirect "$1" "$((${#beforeTrimmed})) $((${#3} + ${#char} - ${#afterTrimmed}))"
-}
-
-
-# Internal: Join / implode an array
-#
-# $1    - Variable name to receive the joined content
-# $2    - Joiner
-# $3-$* - Elements to join
-#
-# Returns nothing.
-moJoin() {
-    local joiner part result target
-
-    target=$1
-    joiner=$2
-    result=$3
-    shift 3
-
-    for part in "$@"; do
-        result="$result$joiner$part"
-    done
-
-    local "$target" && moIndirect "$target" "$result"
-}
-
-
-# Internal: Read a file into a variable.
-#
-# $1 - Variable name to receive the file's content
-# $2 - Filename to load - if empty, defaults to /dev/stdin
-#
-# Returns nothing.
-moLoadFile() {
-    local content len
-
-    # The subshell removes any trailing newlines.  We forcibly add
-    # a dot to the content to preserve all newlines.
-    # As a future optimization, it would be worth considering removing
-    # cat and replacing this with a read loop.
-
-    content=$(cat -- "${2:-/dev/stdin}" && echo '.') || return 1
-    len=$((${#content} - 1))
-    content=${content:0:$len}  # Remove last dot
-
-    local "$1" && moIndirect "$1" "$content"
-}
-
-
-# Internal: Process a chunk of content some number of times.  Writes output
-# to stdout.
-#
-# $1   - Content to parse repeatedly
-# $2   - Tag prefix (context name)
-# $3-@ - Names to insert into the parsed content
-#
-# Returns nothing.
-moLoop() {
-    local content context contextBase
-
-    content=$1
-    contextBase=$2
-    shift 2
-
-    while [[ "${#@}" -gt 0 ]]; do
-        moFullTagName context "$contextBase" "$1"
-        moParse "$content" "$context" false
-        shift
-    done
-}
-
-
-# Internal: Parse a block of text, writing the result to stdout.
-#
-# $1 - Block of text to change
-# $2 - Current name (the variable NAME for what {{.}} means)
-# $3 - true when no content before this, false otherwise
-#
-# Returns nothing.
-moParse() {
-    # Keep naming variables mo* here to not overwrite needed variables
-    # used in the string replacements
-    local moArgs moBlock moContent moCurrent moIsBeginning moNextIsBeginning moTag
-
-    moCurrent=$2
-    moIsBeginning=$3
-
-    # Find open tags
-    moSplit moContent "$1" '{{' '}}'
-
-    while [[ "${#moContent[@]}" -gt 1 ]]; do
-        moTrimWhitespace moTag "${moContent[1]}"
-        moNextIsBeginning=false
-
-        case $moTag in
-            '#'*)
-                # Loop, if/then, or pass content through function
-                # Sets context
-                moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning"
-                moTrimWhitespace moTag "${moTag:1}"
-
-                # Split arguments from the tag name. Arguments are passed to
-                # functions.
-                moArgs=$moTag
-                moTag=${moTag%% *}
-                moTag=${moTag%%$'\t'*}
-                moArgs=${moArgs:${#moTag}}
-                moFindEndTag moBlock "$moContent" "$moTag"
-                moFullTagName moTag "$moCurrent" "$moTag"
-
-                if moTest "$moTag"; then
-                    # Show / loop / pass through function
-                    if moIsFunction "$moTag"; then
-                        moCallFunction moContent "$moTag" "${moBlock[0]}" "$moArgs"
-                        moParse "$moContent" "$moCurrent" false
-                        moContent="${moBlock[2]}"
-                    elif moIsArray "$moTag"; then
-                        eval "moLoop \"\${moBlock[0]}\" \"$moTag\" \"\${!${moTag}[@]}\""
-                    else
-                        moParse "${moBlock[0]}" "$moCurrent" true
-                    fi
-                fi
-
-                moContent="${moBlock[2]}"
-                ;;
-
-            '>'*)
-                # Load partial - get name of file relative to cwd
-                moPartial moContent "${moContent[@]}" "$moIsBeginning" "$moCurrent"
-                moNextIsBeginning=${moContent[1]}
-                moContent=${moContent[0]}
-                ;;
-
-            '/'*)
-                # Closing tag - If hit in this loop, we simply ignore
-                # Matching tags are found in moFindEndTag
-                moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning"
-                ;;
-
-            '^'*)
-                # Display section if named thing does not exist
-                moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning"
-                moTrimWhitespace moTag "${moTag:1}"
-                moFindEndTag moBlock "$moContent" "$moTag"
-                moFullTagName moTag "$moCurrent" "$moTag"
-
-                if ! moTest "$moTag"; then
-                    moParse "${moBlock[0]}" "$moCurrent" false "$moCurrent"
-                fi
-
-                moContent="${moBlock[2]}"
-                ;;
-
-            '!'*)
-                # Comment - ignore the tag content entirely
-                # Trim spaces/tabs before the comment
-                moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning"
-                ;;
-
-            .)
-                # Current content (environment variable or function)
-                moStandaloneDenied moContent "${moContent[@]}"
-                moShow "$moCurrent" "$moCurrent"
-                ;;
-
-            '=')
-                # Change delimiters
-                # Any two non-whitespace sequences separated by whitespace.
-                # This tag is ignored.
-                moStandaloneAllowed moContent "${moContent[@]}" "$moIsBeginning"
-                ;;
-
-            '{'*)
-                # Unescaped - split on }}} not }}
-                moStandaloneDenied moContent "${moContent[@]}"
-                moContent="${moTag:1}"'}}'"$moContent"
-                moSplit moContent "$moContent" '}}}'
-                moTrimWhitespace moTag "${moContent[0]}"
-                moArgs=$moTag
-                moTag=${moTag%% *}
-                moTag=${moTag%%$'\t'*}
-                moArgs=${moArgs:${#moTag}}
-                moFullTagName moTag "$moCurrent" "$moTag"
-                moContent=${moContent[1]}
-
-                # Now show the value
-                # Quote moArgs here, do not quote it later.
-                moShow "$moTag" "$moCurrent" "$moArgs"
-                ;;
-
-            '&'*)
-                # Unescaped
-                moStandaloneDenied moContent "${moContent[@]}"
-                moTrimWhitespace moTag "${moTag:1}"
-                moFullTagName moTag "$moCurrent" "$moTag"
-                moShow "$moTag" "$moCurrent"
-                ;;
-
-            *)
-                # Normal environment variable or function call
-                moStandaloneDenied moContent "${moContent[@]}"
-                moArgs=$moTag
-                moTag=${moTag%% *}
-                moTag=${moTag%%$'\t'*}
-                moArgs=${moArgs:${#moTag}}
-                moFullTagName moTag "$moCurrent" "$moTag"
-
-                # Quote moArgs here, do not quote it later.
-                moShow "$moTag" "$moCurrent" "$moArgs"
-                ;;
-        esac
-
-        moIsBeginning=$moNextIsBeginning
-        moSplit moContent "$moContent" '{{' '}}'
-    done
-
-    echo -n "${moContent[0]}"
-}
-
-
-# Internal: Process a partial.
-#
-# Indentation should be applied to the entire partial.
-#
-# This sends back the "is beginning" flag because the newline after a
-# standalone partial is consumed. That newline is very important in the middle
-# of content. We send back this flag to reset the processing loop's
-# `moIsBeginning` variable, so the software thinks we are back at the
-# beginning of a file and standalone processing continues to work.
-#
-# Prefix all variables.
-#
-# $1 - Name of destination variable. Element [0] is the content, [1] is the
-#      true/false flag indicating if we are at the beginning of content.
-# $2 - Content before the tag that was not yet written
-# $3 - Tag content
-# $4 - Content after the tag
-# $5 - true/false: is this the beginning of the content?
-# $6 - Current context name
-#
-# Returns nothing.
-moPartial() {
-    # Namespace variables here to prevent conflicts.
-    local moContent moFilename moIndent moIsBeginning moPartial moStandalone moUnindented
-
-    if moIsStandalone moStandalone "$2" "$4" "$5"; then
-        # shellcheck disable=SC2206
-        moStandalone=( $moStandalone )
-        echo -n "${2:0:${moStandalone[0]}}"
-        moIndent=${2:${moStandalone[0]}}
-        moContent=${4:${moStandalone[1]}}
-        moIsBeginning=true
-    else
-        moIndent=""
-        echo -n "$2"
-        moContent=$4
-        moIsBeginning=$5
-    fi
-
-    moTrimWhitespace moFilename "${3:1}"
-
-    # Execute in subshell to preserve current cwd and environment
-    (
-        # It would be nice to remove `dirname` and use a function instead,
-        # but that's difficult when you're only given filenames.
-        cd "$(dirname -- "$moFilename")" || exit 1
-        moUnindented="$(
-            moLoadFile moPartial "${moFilename##*/}" || exit 1
-            moParse "${moPartial}" "$6" true
-
-            # Fix bash handling of subshells and keep trailing whitespace.
-            # This is removed in moIndentLines.
-            echo -n "."
-        )" || exit 1
-        moIndentLines moPartial "$moIndent" "$moUnindented"
-        echo -n "$moPartial"
-    ) || exit 1
-
-    # If this is a standalone tag, the trailing newline after the tag is
-    # removed and the contents of the partial are added, which typically
-    # contain a newline. We need to send a signal back to the processing
-    # loop that the moIsBeginning flag needs to be turned on again.
-    #
-    # [0] is the content, [1] is that flag.
-    local "$1" && moIndirectArray "$1" "$moContent" "$moIsBeginning"
-}
-
-
-# Internal: Show an environment variable or the output of a function to
-# stdout.
-#
-# Limit/prefix any variables used.
-#
-# $1 - Name of environment variable or function
-# $2 - Current context
-# $3 - Arguments string if $1 is a function
-#
-# Returns nothing.
-moShow() {
-    # Namespace these variables
-    local moJoined moNameParts moContent
-
-    if moIsFunction "$1"; then
-        moCallFunction moContent "$1" "" "$3"
-        moParse "$moContent" "$2" false
-        return 0
-    fi
-
-    moSplit moNameParts "$1" "."
-
-    if [[ -z "${moNameParts[1]-}" ]]; then
-        if moIsArray "$1"; then
-            eval moJoin moJoined "," "\${$1[@]}"
-            echo -n "$moJoined"
-        else
-            # shellcheck disable=SC2031
-            if moTestVarSet "$1"; then
-                echo -n "${!1}"
-            elif [[ -n "${MO_FAIL_ON_UNSET-}" ]]; then
-                echo "Env variable not set: $1" >&2
-                exit 1
-            fi
-        fi
-    else
-        # Further subindexes are disallowed
-        eval "echo -n \"\${${moNameParts[0]}[${moNameParts[1]%%.*}]}\""
-    fi
-}
-
-
-# Internal: Split a larger string into an array.
-#
-# $1 - Destination variable
-# $2 - String to split
-# $3 - Starting delimiter
-# $4 - Ending delimiter (optional)
-#
-# Returns nothing.
-moSplit() {
-    local pos result
-
-    result=( "$2" )
-    moFindString pos "${result[0]}" "$3"
-
-    if [[ "$pos" -ne -1 ]]; then
-        # The first delimiter was found
-        result[1]=${result[0]:$pos + ${#3}}
-        result[0]=${result[0]:0:$pos}
-
-        if [[ -n "${4-}" ]]; then
-            moFindString pos "${result[1]}" "$4"
-
-            if [[ "$pos" -ne -1 ]]; then
-                # The second delimiter was found
-                result[2]="${result[1]:$pos + ${#4}}"
-                result[1]="${result[1]:0:$pos}"
-            fi
-        fi
-    fi
-
-    local "$1" && moIndirectArray "$1" "${result[@]}"
-}
-
-
-# Internal: Handle the content for a standalone tag.  This means removing
-# whitespace (not newlines) before a tag and whitespace and a newline after
-# a tag.  That is, assuming, that the line is otherwise empty.
-#
-# $1 - Name of destination "content" variable.
-# $2 - Content before the tag that was not yet written
-# $3 - Tag content (not used)
-# $4 - Content after the tag
-# $5 - true/false: is this the beginning of the content?
-#
-# Returns nothing.
-moStandaloneAllowed() {
-    local bytes
-
-    if moIsStandalone bytes "$2" "$4" "$5"; then
-        # shellcheck disable=SC2206
-        bytes=( $bytes )
-        echo -n "${2:0:${bytes[0]}}"
-        local "$1" && moIndirect "$1" "${4:${bytes[1]}}"
-    else
-        echo -n "$2"
-        local "$1" && moIndirect "$1" "$4"
-    fi
-}
-
-
-# Internal: Handle the content for a tag that is never "standalone".  No
-# adjustments are made for newlines and whitespace.
-#
-# $1 - Name of destination "content" variable.
-# $2 - Content before the tag that was not yet written
-# $3 - Tag content (not used)
-# $4 - Content after the tag
-#
-# Returns nothing.
-moStandaloneDenied() {
-    echo -n "$2"
-    local "$1" && moIndirect "$1" "$4"
-}
-
-
-# Internal: Determines if the named thing is a function or if it is a
-# non-empty environment variable.  When MO_FALSE_IS_EMPTY is set to a
-# non-empty value, then "false" is also treated is an empty value.
-#
-# Do not use variables without prefixes here if possible as this needs to
-# check if any name exists in the environment
-#
-# $1                - Name of environment variable or function
-# $2                - Current value (our context)
-# MO_FALSE_IS_EMPTY - When set to a non-empty value, this will say the
-#                     string value "false" is empty.
-#
-# Returns 0 if the name is not empty, 1 otherwise.  When MO_FALSE_IS_EMPTY
-# is set, this returns 1 if the name is "false".
-moTest() {
-    # Test for functions
-    moIsFunction "$1" && return 0
-
-    if moIsArray "$1"; then
-        # Arrays must have at least 1 element
-        eval "[[ \"\${#${1}[@]}\" -gt 0 ]]" && return 0
-    else
-        # If MO_FALSE_IS_EMPTY is set, then return 1 if the value of
-        # the variable is "false".
-        # shellcheck disable=SC2031
-        [[ -n "${MO_FALSE_IS_EMPTY-}" ]] && [[ "${!1-}" == "false" ]] && return 1
-
-        # Environment variables must not be empty
-        [[ -n "${!1-}" ]] && return 0
-    fi
-
-    return 1
-}
-
-# Internal: Determine if a variable is assigned, even if it is assigned an empty
-# value.
-#
-# $1 - Variable name to check.
-#
-# Returns true (0) if the variable is set, 1 if the variable is unset.
-moTestVarSet() {
-    [[ "${!1-a}" == "${!1-b}" ]]
-}
-
-
-# Internal: Trim the leading whitespace only.
-#
-# $1   - Name of destination variable
-# $2   - The string
-# $3   - true/false - trim front?
-# $4   - true/false - trim end?
-# $5-@ - Characters to trim
-#
-# Returns nothing.
-moTrimChars() {
-    local back current front last target varName
-
-    target=$1
-    current=$2
-    front=$3
-    back=$4
-    last=""
-    shift 4 # Remove target, string, trim front flag, trim end flag
-
-    while [[ "$current" != "$last" ]]; do
-        last=$current
-
-        for varName in "$@"; do
-            $front && current="${current/#$varName}"
-            $back && current="${current/%$varName}"
-        done
-    done
-
-    local "$target" && moIndirect "$target" "$current"
-}
-
-
-# Internal: Trim leading and trailing whitespace from a string.
-#
-# $1 - Name of variable to store trimmed string
-# $2 - The string
-#
-# Returns nothing.
-moTrimWhitespace() {
-    local result
-
-    moTrimChars result "$2" true true $'\r' $'\n' $'\t' " "
-    local "$1" && moIndirect "$1" "$result"
-}
-
-
-# Internal: Displays the usage for mo.  Pulls this from the file that
-# contained the `mo` function.  Can only work when the right filename
-# comes is the one argument, and that only happens when `mo` is called
-# with `$0` set to this file.
-#
-# $1 - Filename that has the help message
-#
-# Returns nothing.
-moUsage() {
-    grep '^#/' "${MO_ORIGINAL_COMMAND}" | cut -c 4-
-    echo ""
-    echo "MO_VERSION=$MO_VERSION"
-}
-
-
-# Save the original command's path for usage later
-MO_ORIGINAL_COMMAND="$(cd "${BASH_SOURCE[0]%/*}" || exit 1; pwd)/${BASH_SOURCE[0]##*/}"
-MO_VERSION="2.2.0"
-
-# If sourced, load all functions.
-# If executed, perform the actions as expected.
-if [[ "$0" == "${BASH_SOURCE[0]}" ]] || [[ -z "${BASH_SOURCE[0]}" ]]; then
-    mo "$@"
-fi
diff --git a/docker/certbot/entrypoint.sh b/docker/certbot/entrypoint.sh
new file mode 100755
index 00000000..8d291604
--- /dev/null
+++ b/docker/certbot/entrypoint.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Portal domain requires 3 domain certificates:
+# - exact portal domain, ie. example.com
+# - wildcard subdomain on portal domain, ie. *.example.com
+#   used for skylinks served from portal subdomain
+# - wildcard subdomain on hns portal domain subdomain, ie. *.hns.example.com
+#   used for resolving handshake domains
+DOMAINS=${PORTAL_DOMAIN},*.${PORTAL_DOMAIN},*.hns.${PORTAL_DOMAIN}
+
+# Add server domain when it is not empty and different from portal domain
+if [ ! -z "${SERVER_DOMAIN}" ] && [ "${PORTAL_DOMAIN}" != "${SERVER_DOMAIN}" ]; then
+    # In case where server domain is not covered by portal domain's
+    # wildcard certificate, add server domain name to domains list.
+    # - server-001.example.com is covered by *.example.com
+    # - server-001.servers.example.com or server-001.example-severs.com
+    #   are not covered by any already requested wildcard certificates
+    #
+    # The condition checks whether server domain does not match portal domain
+    # with exactly one level of subdomain (portal domain wildcard cert):
+    # (start) [anything but the dot] + [dot] + [portal domain] (end)
+    if ! printf "${SERVER_DOMAIN}" | grep -q -E "^[^\.]+\.${PORTAL_DOMAIN}$"; then
+        DOMAINS=${DOMAINS},${SERVER_DOMAIN}
+    fi
+
+    # Server domain requires the same set of domain certificates as portal domain.
+    # Exact server domain case is handled above.
+    DOMAINS=${DOMAINS},*.${SERVER_DOMAIN},*.hns.${SERVER_DOMAIN}
+fi
+
+# The "wait" will prevent an exit from the script while background tasks are
+# still active, so we are adding the line below as a method to prevent orphaning
+# the background child processe. The trap fires when docker terminates the container.
+trap exit TERM
+
+while :; do
+    # Execute certbot and generate or maintain certificates for given domain string.
+    # --non-interactive: we are running this as an automation so we cannot be prompted
+    # --agree-tos: required flag marking agreement with letsencrypt tos
+    # --cert-name: output directory name
+    # --email: required for generating certificates, used for communication with CA
+    # --domains: comma separated list of domains (will generate one bundled SAN cert)
+    # Use CERTBOT_ARGS env variable to pass any additional arguments, ie --dns-route53
+    certbot certonly \
+        --non-interactive --agree-tos --cert-name skynet-portal \
+        --email ${EMAIL_ADDRESS} --domains ${DOMAINS} ${CERTBOT_ARGS}
+
+    # Run a background sleep process that counts down given time
+    # Certbot docs advise running maintenance process every 12 hours
+    sleep 12h &
+    
+    # Await execution until sleep process is finished (it's a background process)
+    # Syntax explanation: ${!} expands to a pid of last ran process
+    wait ${!}
+done
diff --git a/docker/nginx/Dockerfile b/docker/nginx/Dockerfile
index c8ef7baf..53944d8e 100644
--- a/docker/nginx/Dockerfile
+++ b/docker/nginx/Dockerfile
@@ -18,5 +18,6 @@ CMD [ "bash", "-c", \
        ./mo < /etc/nginx/conf.d.templates/server.api.conf > /etc/nginx/conf.d/server.api.conf; \
        ./mo < /etc/nginx/conf.d.templates/server.hns.conf > /etc/nginx/conf.d/server.hns.conf; \
        ./mo < /etc/nginx/conf.d.templates/server.skylink.conf > /etc/nginx/conf.d/server.skylink.conf ; \
+       while :; do sleep 6h & wait ${!}; /usr/local/openresty/bin/openresty -s reload; done & \
        /usr/local/openresty/bin/openresty '-g daemon off;'" \
     ]
diff --git a/docker/nginx/conf.d.templates/server.account.conf b/docker/nginx/conf.d.templates/server.account.conf
index c83cc208..af3b7c4d 100644
--- a/docker/nginx/conf.d.templates/server.account.conf
+++ b/docker/nginx/conf.d.templates/server.account.conf
@@ -18,9 +18,6 @@
 			return "{{SERVER_DOMAIN}}"
 		}
 
-		ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{PORTAL_DOMAIN}}/wildcard_.{{PORTAL_DOMAIN}}.crt;
-		ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{PORTAL_DOMAIN}}/wildcard_.{{PORTAL_DOMAIN}}.key;
-
 		include /etc/nginx/conf.d/server/server.account;
 	}
 	{{/PORTAL_DOMAIN}}
@@ -37,9 +34,6 @@
 	server {
 		server_name account.{{SERVER_DOMAIN}}; # example: account.eu-ger-1.siasky.net
 
-		ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{SERVER_DOMAIN}}/wildcard_.{{SERVER_DOMAIN}}.crt;
-		ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{SERVER_DOMAIN}}/wildcard_.{{SERVER_DOMAIN}}.key;
-
 		set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" }
 		set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" }
 
diff --git a/docker/nginx/conf.d.templates/server.api.conf b/docker/nginx/conf.d.templates/server.api.conf
index 0421ed29..591212ba 100644
--- a/docker/nginx/conf.d.templates/server.api.conf
+++ b/docker/nginx/conf.d.templates/server.api.conf
@@ -17,9 +17,6 @@ server {
 		return "{{SERVER_DOMAIN}}"
 	}
 
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{{PORTAL_DOMAIN}}/{{PORTAL_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{{PORTAL_DOMAIN}}/{{PORTAL_DOMAIN}}.key;
-
 	include /etc/nginx/conf.d/server/server.api;
 }
 {{/PORTAL_DOMAIN}}
@@ -36,9 +33,6 @@ server {
 server {
 	server_name {{SERVER_DOMAIN}}; # example: eu-ger-1.siasky.net
 
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{{SERVER_DOMAIN}}/{{SERVER_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{{SERVER_DOMAIN}}/{{SERVER_DOMAIN}}.key;
-
 	set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" }
 	set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" }
 
diff --git a/docker/nginx/conf.d.templates/server.hns.conf b/docker/nginx/conf.d.templates/server.hns.conf
index bbd24d60..0e4f21f3 100644
--- a/docker/nginx/conf.d.templates/server.hns.conf
+++ b/docker/nginx/conf.d.templates/server.hns.conf
@@ -17,9 +17,6 @@ server {
 		return "{{SERVER_DOMAIN}}"
 	}
 
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.hns.{{PORTAL_DOMAIN}}/wildcard_.hns.{{PORTAL_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.hns.{{PORTAL_DOMAIN}}/wildcard_.hns.{{PORTAL_DOMAIN}}.key;
-    
 	proxy_set_header Host {{PORTAL_DOMAIN}};
 	include /etc/nginx/conf.d/server/server.hns;
 }
@@ -37,9 +34,6 @@ server {
 server {
 	server_name *.hns.{{SERVER_DOMAIN}}; # example: *.hns.eu-ger-1.siasky.net
 	
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.hns.{{SERVER_DOMAIN}}/wildcard_.hns.{{SERVER_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.hns.{{SERVER_DOMAIN}}/wildcard_.hns.{{SERVER_DOMAIN}}.key;
-
 	set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" }
 	set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" }
     
diff --git a/docker/nginx/conf.d.templates/server.skylink.conf b/docker/nginx/conf.d.templates/server.skylink.conf
index 792ad901..a97e240c 100644
--- a/docker/nginx/conf.d.templates/server.skylink.conf
+++ b/docker/nginx/conf.d.templates/server.skylink.conf
@@ -17,9 +17,6 @@ server {
 		return "{{SERVER_DOMAIN}}"
 	}
 
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{PORTAL_DOMAIN}}/wildcard_.{{PORTAL_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{PORTAL_DOMAIN}}/wildcard_.{{PORTAL_DOMAIN}}.key;
-	
 	include /etc/nginx/conf.d/server/server.skylink;
 }
 {{/PORTAL_DOMAIN}}
@@ -39,9 +36,6 @@ server {
 	set_by_lua_block $skynet_portal_domain { return "{{SERVER_DOMAIN}}" }
 	set_by_lua_block $skynet_server_domain { return "{{SERVER_DOMAIN}}" }
 	
-	ssl_certificate     /data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{SERVER_DOMAIN}}/wildcard_.{{SERVER_DOMAIN}}.crt;
-	ssl_certificate_key	/data/caddy/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.{{SERVER_DOMAIN}}/wildcard_.{{SERVER_DOMAIN}}.key;
-	
 	include /etc/nginx/conf.d/server/server.skylink;
 	
 	set_by_lua_block $server_alias { return string.match("{{SERVER_DOMAIN}}", "^([^.]+)") }
diff --git a/docker/nginx/conf.d/include/ssl-settings b/docker/nginx/conf.d/include/ssl-settings
index e4a82394..545d372b 100644
--- a/docker/nginx/conf.d/include/ssl-settings
+++ b/docker/nginx/conf.d/include/ssl-settings
@@ -1,7 +1,10 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1d&hsts=false&ocsp=false&guideline=5.6
 
+ssl_certificate /etc/letsencrypt/live/skynet-portal/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/skynet-portal/privkey.pem;
+
 ssl_session_timeout 1d;
-ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
 ssl_session_tickets off;
 
 # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
@@ -11,3 +14,13 @@ ssl_dhparam /etc/nginx/conf.d/dhparam.pem;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
 ssl_prefer_server_ciphers off;
+
+# HSTS (ngx_http_headers_module is required) (63072000 seconds)
+add_header Strict-Transport-Security "max-age=63072000" always;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# verify chain of trust of OCSP response using Root CA and Intermediate certs
+ssl_trusted_certificate /etc/letsencrypt/live/skynet-portal/chain.pem;
diff --git a/packages/website/package.json b/packages/website/package.json
index d826cc67..76737420 100644
--- a/packages/website/package.json
+++ b/packages/website/package.json
@@ -15,12 +15,12 @@
     "framer-motion": "6.2.8",
     "gatsby": "4.10.1",
     "gatsby-background-image": "1.6.0",
-    "gatsby-plugin-image": "2.9.0",
+    "gatsby-plugin-image": "2.10.0",
     "gatsby-plugin-manifest": "4.10.1",
-    "gatsby-plugin-postcss": "5.9.0",
+    "gatsby-plugin-postcss": "5.10.0",
     "gatsby-plugin-react-helmet": "5.10.0",
     "gatsby-plugin-robots-txt": "1.7.0",
-    "gatsby-plugin-sharp": "4.9.1",
+    "gatsby-plugin-sharp": "4.10.1",
     "gatsby-plugin-sitemap": "5.10.1",
     "gatsby-plugin-svgr": "3.0.0-beta.0",
     "gatsby-source-filesystem": "4.10.0",
@@ -48,7 +48,7 @@
     "@tailwindcss/typography": "0.5.2",
     "autoprefixer": "10.4.4",
     "cross-env": "7.0.3",
-    "cypress": "9.5.1",
+    "cypress": "9.5.2",
     "prettier": "2.6.0",
     "tailwindcss": "3.0.23"
   },
diff --git a/packages/website/yarn.lock b/packages/website/yarn.lock
index 710cfb59..78db47fe 100644
--- a/packages/website/yarn.lock
+++ b/packages/website/yarn.lock
@@ -3339,7 +3339,7 @@ babel-plugin-polyfill-regenerator@^0.3.0:
   dependencies:
     "@babel/helper-define-polyfill-provider" "^0.3.1"
 
-babel-plugin-remove-graphql-queries@^4.10.0, babel-plugin-remove-graphql-queries@^4.9.0:
+babel-plugin-remove-graphql-queries@^4.10.0:
   version "4.10.0"
   resolved "https://registry.yarnpkg.com/babel-plugin-remove-graphql-queries/-/babel-plugin-remove-graphql-queries-4.10.0.tgz#882ec7e75627ffd844e5c4c6d7ae50afe87bc415"
   integrity sha512-vANJvjh03qC7o6O3huCKO+Jtmee9WPUJm4Nm+qn/ww+GOOQwz0Z0bSMeBhUkJbT/Y1b1JlysHoxTO3ZNH47EwA==
@@ -4613,10 +4613,10 @@ custom-error-instance@2.1.1:
   resolved "https://registry.yarnpkg.com/custom-error-instance/-/custom-error-instance-2.1.1.tgz#3cf6391487a6629a6247eb0ca0ce00081b7e361a"
   integrity sha1-PPY5FIemYppiR+sMoM4ACBt+Nho=
 
-cypress@9.5.1:
-  version "9.5.1"
-  resolved "https://registry.yarnpkg.com/cypress/-/cypress-9.5.1.tgz#51162f3688cedf5ffce311b914ef49a7c1ece076"
-  integrity sha512-H7lUWB3Svr44gz1rNnj941xmdsCljXoJa2cDneAltjI9leKLMQLm30x6jLlpQ730tiVtIbW5HdUmBzPzwzfUQg==
+cypress@9.5.2:
+  version "9.5.2"
+  resolved "https://registry.yarnpkg.com/cypress/-/cypress-9.5.2.tgz#8fb6ee4a890fbc35620800810bf6fb11995927bd"
+  integrity sha512-gYiQYvJozMzDOriUV1rCt6CeRM/pRK4nhwGJj3nJQyX2BoUdTCVwp30xDMKc771HiNVhBtgj5o5/iBdVDVXQUg==
   dependencies:
     "@cypress/request" "^2.88.10"
     "@cypress/xvfb" "^1.2.4"
@@ -4759,7 +4759,7 @@ deep-is@^0.1.3:
   resolved "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz#a6f2dce612fadd2ef1f519b73551f17e85199831"
   integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==
 
-deepmerge@^4.0.0, deepmerge@^4.2.2:
+deepmerge@^4.2.2:
   version "4.2.2"
   resolved "https://registry.yarnpkg.com/deepmerge/-/deepmerge-4.2.2.tgz#44d2ea3679b8f4d4ffba33f03d865fc1e7bf4955"
   integrity sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==
@@ -6223,7 +6223,7 @@ gatsby-cli@^4.10.1:
     yoga-layout-prebuilt "^1.10.0"
     yurnalist "^2.1.0"
 
-gatsby-core-utils@^3.10.0, gatsby-core-utils@^3.8.2, gatsby-core-utils@^3.9.0, gatsby-core-utils@^3.9.1:
+gatsby-core-utils@^3.10.0, gatsby-core-utils@^3.8.2:
   version "3.10.0"
   resolved "https://registry.yarnpkg.com/gatsby-core-utils/-/gatsby-core-utils-3.10.0.tgz#52be8a9a891d95686a7ee0c1cfef44f8e362232b"
   integrity sha512-yaRI/uUsbIggPRfh0y6CH+fy2AqbFFLxCYndw5nrVByEY40+KaKs0wOF4yIgPRBZZUHOyfBJ+1AGo2JLHdY5lA==
@@ -6306,22 +6306,22 @@ gatsby-parcel-config@^0.1.0:
     "@parcel/transformer-raw" "^2.3.1"
     "@parcel/transformer-react-refresh-wrap" "^2.3.1"
 
-gatsby-plugin-image@2.9.0:
-  version "2.9.0"
-  resolved "https://registry.yarnpkg.com/gatsby-plugin-image/-/gatsby-plugin-image-2.9.0.tgz#4656dec9c93aec233792012ec952328e3dd702f7"
-  integrity sha512-2LIKmwACRNXBnh30zNhlfEDjSPL60G8vi4ZRAmMpywq7SVXJJ63lKiBRF+g2aKcN/hW0hvBPh0hgQifxSBhbYA==
+gatsby-plugin-image@2.10.0:
+  version "2.10.0"
+  resolved "https://registry.yarnpkg.com/gatsby-plugin-image/-/gatsby-plugin-image-2.10.0.tgz#8b4bb0bb2113ab5fa542e52e83f75228ff577703"
+  integrity sha512-W6/RvRs27XG5TwxTEAhnY68g0LAqP6T2NDPPEzAe/V/x5PyPn5Zf/N1pPUoqqdJ2n48Wg2BSv3Asz5/4vHfRgw==
   dependencies:
     "@babel/code-frame" "^7.14.0"
     "@babel/parser" "^7.15.5"
     "@babel/runtime" "^7.15.4"
     "@babel/traverse" "^7.15.4"
     babel-jsx-utils "^1.1.0"
-    babel-plugin-remove-graphql-queries "^4.9.0"
+    babel-plugin-remove-graphql-queries "^4.10.0"
     camelcase "^5.3.1"
     chokidar "^3.5.2"
     common-tags "^1.8.2"
     fs-extra "^10.0.0"
-    gatsby-core-utils "^3.9.0"
+    gatsby-core-utils "^3.10.0"
     objectFitPolyfill "^2.3.5"
     prop-types "^15.7.2"
 
@@ -6353,10 +6353,10 @@ gatsby-plugin-page-creator@^4.10.1:
     globby "^11.0.4"
     lodash "^4.17.21"
 
-gatsby-plugin-postcss@5.9.0:
-  version "5.9.0"
-  resolved "https://registry.yarnpkg.com/gatsby-plugin-postcss/-/gatsby-plugin-postcss-5.9.0.tgz#c1e1888ec6738a4c25e4cafd7acc6d377e5a9603"
-  integrity sha512-G94aaf2TvD6XEn1CfXENOlcwjNiU9LK644Ofe1Q+vuV17XmboV2DuBsuNkFJuYKQzJ0FuZ8bomE3EK39SfFpfg==
+gatsby-plugin-postcss@5.10.0:
+  version "5.10.0"
+  resolved "https://registry.yarnpkg.com/gatsby-plugin-postcss/-/gatsby-plugin-postcss-5.10.0.tgz#e241f1671e66f7b660826f39fd26591aae652716"
+  integrity sha512-s1zzysu1kKIqR+CfQeQsG0CCdj2S7tjc4BhCY2a3V4cl7ORJtMx1HGKDUzE9gV/EXRTmr9lhE9Gl+2v8fRouvA==
   dependencies:
     "@babel/runtime" "^7.15.4"
     postcss-loader "^4.3.0"
@@ -6376,10 +6376,10 @@ gatsby-plugin-robots-txt@1.7.0:
     "@babel/runtime" "^7.16.7"
     generate-robotstxt "^8.0.3"
 
-gatsby-plugin-sharp@4.9.1:
-  version "4.9.1"
-  resolved "https://registry.yarnpkg.com/gatsby-plugin-sharp/-/gatsby-plugin-sharp-4.9.1.tgz#44667f134be1855fe666ed58839bd280527337bd"
-  integrity sha512-oHnuxIok0Ct3nktn53XQFX36QXwa4H9hjj5lkxaY3zh0giYJmFAsHyvus6DKzGQ14cTC3AkvaD+rqv4SGdjRcg==
+gatsby-plugin-sharp@4.10.1:
+  version "4.10.1"
+  resolved "https://registry.yarnpkg.com/gatsby-plugin-sharp/-/gatsby-plugin-sharp-4.10.1.tgz#d72145f7649b71a1e5051dcf7ed8f4d1f72bb041"
+  integrity sha512-Y+kB5BSfcxMYO5s13W3NDeDH28RCzSa8goo1yQNTISiGaC6iBO4EIEVbUiUBkoLA5nf46J71ve8A3sprZ66bog==
   dependencies:
     "@babel/runtime" "^7.15.4"
     async "^3.2.3"
@@ -6387,14 +6387,14 @@ gatsby-plugin-sharp@4.9.1:
     debug "^4.3.3"
     filenamify "^4.3.0"
     fs-extra "^10.0.0"
-    gatsby-core-utils "^3.9.1"
-    gatsby-plugin-utils "^3.3.0"
-    gatsby-telemetry "^3.9.1"
+    gatsby-core-utils "^3.10.0"
+    gatsby-plugin-utils "^3.4.1"
+    gatsby-telemetry "^3.10.0"
     got "^11.8.3"
     lodash "^4.17.21"
     mini-svg-data-uri "^1.4.3"
     potrace "^2.1.8"
-    probe-image-size "^6.0.0"
+    probe-image-size "^7.0.0"
     progress "^2.0.3"
     semver "^7.3.5"
     sharp "^0.30.1"
@@ -6429,7 +6429,7 @@ gatsby-plugin-typescript@^4.10.0:
     "@babel/runtime" "^7.15.4"
     babel-plugin-remove-graphql-queries "^4.10.0"
 
-gatsby-plugin-utils@^3.3.0, gatsby-plugin-utils@^3.4.1:
+gatsby-plugin-utils@^3.4.1:
   version "3.4.1"
   resolved "https://registry.yarnpkg.com/gatsby-plugin-utils/-/gatsby-plugin-utils-3.4.1.tgz#14c9cff75af32a32860575069af44bdabc8f65d9"
   integrity sha512-sDMVGauxMgXyX8WGZDndZI2vIaolJzlXBMdKhgP7DIT+Qa5wjvyHWvZy34dxtVrT3IHPK/PRMgpE81Gr7gKveg==
@@ -6477,7 +6477,7 @@ gatsby-source-filesystem@4.10.0:
     valid-url "^1.0.9"
     xstate "^4.26.1"
 
-gatsby-telemetry@^3.10.0, gatsby-telemetry@^3.9.1:
+gatsby-telemetry@^3.10.0:
   version "3.10.0"
   resolved "https://registry.yarnpkg.com/gatsby-telemetry/-/gatsby-telemetry-3.10.0.tgz#917a4914e531d401ecf98ac87d29128b30bfab13"
   integrity sha512-Oe2OShJbylKr5C4FTl2P/JUX/xRkpYb6IMfEoAd5inG7HNQ1fikON4NdwvJjOp++My4kWo+LLCu92TZBkyTtZw==
@@ -9958,15 +9958,6 @@ pretty-error@^2.1.2:
     lodash "^4.17.20"
     renderkid "^2.0.4"
 
-probe-image-size@^6.0.0:
-  version "6.0.0"
-  resolved "https://registry.yarnpkg.com/probe-image-size/-/probe-image-size-6.0.0.tgz#4a85b19d5af4e29a8de7d53a9aa036f6fd02f5f4"
-  integrity sha512-99PZ5+RU4gqiTfK5ZDMDkZtn6eL4WlKfFyVJV7lFQvH3iGmQ85DqMTOdxorERO26LHkevR2qsxnHp0x/2UDJPA==
-  dependencies:
-    deepmerge "^4.0.0"
-    needle "^2.5.2"
-    stream-parser "~0.3.1"
-
 probe-image-size@^7.0.0:
   version "7.2.3"
   resolved "https://registry.yarnpkg.com/probe-image-size/-/probe-image-size-7.2.3.tgz#d49c64be540ec8edea538f6f585f65a9b3ab4309"
diff --git a/setup-scripts/support/authorized_keys b/setup-scripts/support/authorized_keys
index 43698a94..6ee7b264 100644
--- a/setup-scripts/support/authorized_keys
+++ b/setup-scripts/support/authorized_keys
@@ -8,4 +8,3 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM43lzbKjFLChe5rKETxDpWpNlqXCGTBPiWlDN2vlLD
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN6Kcx8yetova4/ALUQHigo/PBMJO33ZTKOsg2jxSO2a user@deploy.siasky.dev
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcenWnMQ6q/OEC4ZmQgjLDV2obWlR3fENV0zRGFvJF+ marcins@siasky.net
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7prtVOTwtcSN9HkXum107RwcW5H8Vggx6Qv7T57ItT daniel@siasky.net
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII85HxoIRbPyr+xUjpuFUlQNW7smCNdIcmx2XgpmXnB0 marissa@skynetlabs.com