add ssl_stapling
prefer AESGCM and FIPS, drop SSLv3
use nginx upstream if there is a version specified
add spdy and hsts for roundcube
no need for transports
no need for mailboxes
optimize query