Task-oriented guides, one per subject:

• Listeners and routes — l4 vs http, host/header/prefix route tables, multi-tenant SNI.
• TLS certificates — terminating TLS 1.3, SNI certificate sets, reloads.
• HTTP/3 — the experimental QUIC listener, its limits and its counters.
• WebSockets — tunnelled upgrades and their own pool.
• Rate limiting and the WAF — token buckets, connection caps, the literal denylist.
• Compression — precompressed static bodies and the narrow proxied-response case.
• Upstream TLS — originating TLS 1.3 to your backends, mTLS, verification.
• Access log and admin panel — the JSON log, sinks and rotation, the admin scrape, and the bundled panel.