diff --git a/one-time-stuff/conf/nginx.conf b/one-time-stuff/conf/nginx.conf
index 17e63d3..6f494ed 100644
--- a/one-time-stuff/conf/nginx.conf
+++ b/one-time-stuff/conf/nginx.conf
@@ -6,9 +6,10 @@ upstream php-handler {
 }
 
 server {
+    server_name DOMAIN_TO_USE;
+
     listen 80;
     listen [::]:80;
-    server_name DOMAIN_TO_USE;
 
     # HSTS settings
     # WARNING: Only add the preload option once you read about
@@ -16,7 +17,7 @@ server {
     # will add the domain to a hardcoded list that is shipped
     # in all major browsers and getting removed from this list
     # could take several months.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+    add_header Strict-Transport-Security "max-age=31536000" always;
 
     # set max upload size
     client_max_body_size 512M;
@@ -61,9 +62,6 @@ server {
     # always provides the desired behaviour.
     index index.php index.html /index.php$request_uri;
 
-    # Default Cache-Control policy
-    expires 1m;
-
     # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
     location = / {
         if ( $http_user_agent ~ ^DavClnt ) {
@@ -82,22 +80,23 @@ server {
     # `location ~ /(\.|autotest|...)` which would otherwise handle requests
     # for `/.well-known`.
     location ^~ /.well-known {
-        # The following 6 rules are borrowed from `.htaccess`
+        # The rules in this block are an adaptation of the rules
+        # in `.htaccess` that concern `/.well-known`.
 
-        rewrite ^/\.well-known/host-meta\.json  /public.php?service=host-meta-json  last;
-        rewrite ^/\.well-known/host-meta        /public.php?service=host-meta       last;
-        rewrite ^/\.well-known/webfinger        /public.php?service=webfinger       last;
-        rewrite ^/\.well-known/nodeinfo         /public.php?service=nodeinfo        last;
+        location = /.well-known/carddav { return 301 /remote.php/dav/; }
+        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
 
-        location = /.well-known/carddav     { return 301 /remote.php/dav/; }
-        location = /.well-known/caldav      { return 301 /remote.php/dav/; }
+        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
 
-        try_files $uri $uri/ =404;
+        # Let Nextcloud's API for `/.well-known` URIs handle all other
+        # requests by passing them to the front-end controller.
+        return 301 /index.php$request_uri;
     }
 
     # Rules borrowed from `.htaccess` to hide certain paths from clients
     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)              { return 404; }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
 
     # Ensure this block, which passes PHP files to the PHP process, is above the blocks
     # which handle static assets (as seen below). If this block is not declared first,
@@ -134,6 +133,11 @@ server {
         access_log off;     # Optional: Don't log access to assets
     }
 
+    # Rule borrowed from `.htaccess`
+    location /remote {
+        return 301 /remote.php$request_uri;
+    }
+
     location / {
         try_files $uri $uri/ /index.php$request_uri;
     }
diff --git a/one-time-stuff/x-nextcloud.sh b/one-time-stuff/x-nextcloud.sh
index 13d7701..3614ac6 100755
--- a/one-time-stuff/x-nextcloud.sh
+++ b/one-time-stuff/x-nextcloud.sh
@@ -28,7 +28,7 @@ if [[ -z "$dir_name" ]]; then
     dir_name='/var/www/nextcloud'
 fi
 
-public_ip=`${LOCATION}/../public-ip.sh`
+public_ip=`${LOCATION}/../4-public-ip.sh`
 echo "----- Set NextCloud Domain --------------------------"
 read -p "Domain (defaults to public-ip '${public_ip}'): " domain_name
 if [[ -z "$domain_name" ]]; then
diff --git a/public-ip.sh b/public-ip.sh
index e9e4db5..91d3fc9 100755
--- a/public-ip.sh
+++ b/public-ip.sh
@@ -1,5 +1,10 @@
 #!/bin/bash
 
-dig +short A myip.opendns.com @resolver1.opendns.com
+# does not always work, when you have an IPv6 connection
+# dig +short A myip.opendns.com @resolver1.opendns.com
+
+curl https://ipinfo.io/ip
+echo ""
+
 dig +short AAAA myip.opendns.com @resolver1.opendns.com