Fix cert deletion key and harden nginx SSL/redis handling

- host.remove() now deletes the cert under the host key instead of the
  Domain relation object, so certs are actually removed from redis
- targetinfo.lua returns the redis connection to the pool via
  set_keepalive instead of leaking one connection per request
- autossl.conf drops TLSv1/1.1 and 3DES, adds TLSv1.3

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ops/nginx_conf/autossl.conf

@@ -1,9 +1,9 @@
 listen 443 ssl http2;
 listen 4443 ssl;
 
-ssl_protocols     TLSv1 TLSv1.1 TLSv1.2;
+ssl_protocols     TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers  on;
-ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!3DES:!MD5;
 
 ssl_certificate_by_lua_block {
     auto_ssl:ssl_certificate()

ops/nginx_conf/targetinfo.lua

@@ -37,6 +37,14 @@ function M.get(ngx, domain, targetInfo)
     local res, err = red:hgetall("proxy_Host_"..domain)
     res = red:array_to_hash(res)
 
+    -- Return the connection to the pool instead of closing it, so it can be
+    -- reused by later requests. Without this a new connection is opened per
+    -- request and never released, exhausting sockets under load.
+    local ok, err = red:set_keepalive(10000, 100)
+    if not ok then
+        ngx.log(ngx.ERR, "failed to set redis keepalive: ", err)
+    end
+
     if not res["ip"] then
         if connect("/var/run/proxy_lookup.socket") then 
             local socket = require("socket.unix")()