Perfect Forward Secrecy (PFS) for HTTPS connections made via Nginx. To do: disable external access to port 5984 (CouchDB); redirect all HTTP access to HTTPS URL.
Senseless reordering.