diff --git a/sites-available/affine b/sites-available/affine
index 0cc1b1f..6b1db71 100644
--- a/sites-available/affine
+++ b/sites-available/affine
@@ -1,18 +1,19 @@
+# Block 1: Redirects all HTTP traffic to HTTPS
 server {
     listen 80;
     server_name notes.aaf.systems;
-    # Redirect all HTTP traffic to HTTPS
+
+    # This redirect is managed by Certbot's --redirect flag, 
+    # but we include it for completeness.
     return 301 https://$host$request_uri;
 }
 
+# Block 2: Handles the secure HTTPS traffic
 server {
     listen 443 ssl http2;
     server_name notes.aaf.systems;
 
-    # SSL Certificates (managed by Certbot)
-    ssl_certificate /etc/letsencrypt/live/notes.aaf.systems/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/notes.aaf.systems/privkey.pem;
-
+    # --- This is the location block that was missing ---
     location / {
         proxy_pass http://100.93.165.98:3010;
         proxy_set_header X-Real-IP $remote_addr;
@@ -22,4 +23,11 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
     }
+    # --- End of location block ---
+
+    # SSL settings managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/git.aaf.systems/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/git.aaf.systems/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 }
\ No newline at end of file
diff --git a/sites-available/gitea b/sites-available/gitea
index 3bd2591..cdda7ae 100644
--- a/sites-available/gitea
+++ b/sites-available/gitea
@@ -1,20 +1,18 @@
+# Block 1: Redirects all HTTP traffic to HTTPS
 server {
     listen 80;
     server_name git.aaf.systems;
-    # Redirect all HTTP traffic to HTTPS
     return 301 https://$host$request_uri;
 }
 
+# Block 2: Handles the secure HTTPS traffic
 server {
     listen 443 ssl http2;
     server_name git.aaf.systems;
 
-    # SSL Certificates (managed by Certbot)
-    ssl_certificate /etc/letsencrypt/live/git.aaf.systems/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/git.aaf.systems/privkey.pem;
-
     location / {
-        proxy_pass http://100.93.165.98:3000;
+        # IMPORTANT: Replace with the correct Tailscale IP for your Gitea server
+        proxy_pass http://<IP_OF_GITEA_SERVER>:3000;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -22,4 +20,10 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
     }
+
+    # SSL settings managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/git.aaf.systems/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/git.aaf.systems/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 }
\ No newline at end of file