The app now listens on plain HTTP (127.0.0.1:5023 only) instead of binding 443 and terminating TLS itself. Nginx handles TLS for iptv.mrk.ovh and proxies to the app internally.