firewall: ntpd may emit packet as root
firewall: nginx doesn't need to use domain directly
firewall: but nginx needs access to HTTP for OCSP stapling
transmission: increase download/upload limits