nginx/sites-enabled: uncomment ssl
nginx host: follow Mozilla's recommendations

Applies to that part which looks like something I can follow.
nginx sites-enabled: add rproxy