What looked like a simple nginx config change turned into a tour through SSL library incompatibilities, pf firewall rules for a new protocol, and a multi-worker affinity problem that only shows up ...