diff --git a/etc/nginx/sites-available/airlocksix.com.conf b/etc/nginx/sites-available/airlocksix.com.conf
new file mode 100644
index 0000000..2d373aa
--- /dev/null
+++ b/etc/nginx/sites-available/airlocksix.com.conf
@@ -0,0 +1,209 @@
+# airlocksix.com
+# www.airlocksix.com
+# airlock6.com
+# www.airlock6.com
+
+### airlocksix
+
+server {
+    server_name airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/airlocksix.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/airlocksix.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # https://ssl-config.mozilla.org/
+    add_header Strict-Transport-Security "max-age=15724800" always;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/letsencrypt/live/airlocksix.com/chain.pem;
+    resolver 9.9.9.9 8.8.8.8 1.1.1.1;
+    resolver_timeout 5s;
+
+    # https://observatory.mozilla.org
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';";
+}
+
+server {
+    server_name www.airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location ~ /\.well-known {
+        allow all;
+    }
+
+    location ~ / {
+        return 301 $scheme://airlocksix.com$request_uri;
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/airlocksix.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/airlocksix.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # https://ssl-config.mozilla.org/
+    add_header Strict-Transport-Security "max-age=15724800" always;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/letsencrypt/live/airlocksix.com/chain.pem;
+    resolver 9.9.9.9 8.8.8.8 1.1.1.1;
+    resolver_timeout 5s;
+
+    # https://observatory.mozilla.org
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';";
+}
+
+server {
+    if ($host = airlocksix.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    listen 80;
+    listen [::]:80;
+    server_name airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+    return 404; # managed by Certbot
+}
+
+server {
+    if ($host = www.airlocksix.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    listen 80;
+    listen [::]:80;
+    server_name www.airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+    return 404; # managed by Certbot
+}
+
+### airlock6
+
+server {
+    server_name airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location ~ /\.well-known {
+        allow all;
+    }
+
+    location ~ / {
+        return 301 $scheme://airlocksix.com$request_uri;
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/airlocksix.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/airlocksix.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # https://ssl-config.mozilla.org/
+    add_header Strict-Transport-Security "max-age=15724800" always;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/letsencrypt/live/airlocksix.com/chain.pem;
+    resolver 9.9.9.9 8.8.8.8 1.1.1.1;
+    resolver_timeout 5s;
+
+    # https://observatory.mozilla.org
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';";
+}
+
+server {
+    server_name www.airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location ~ /\.well-known {
+        allow all;
+    }
+
+    location ~ / {
+        return 301 $scheme://airlocksix.com$request_uri;
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/airlocksix.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/airlocksix.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # https://ssl-config.mozilla.org/
+    add_header Strict-Transport-Security "max-age=15724800" always;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/letsencrypt/live/airlocksix.com/chain.pem;
+    resolver 9.9.9.9 8.8.8.8 1.1.1.1;
+    resolver_timeout 5s;
+
+    # https://observatory.mozilla.org
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';";
+}
+
+server {
+    if ($host = airlock6.com) {
+        return 301 https://airlocksix.com$request_uri;
+    } # managed by Certbot
+
+    listen 80;
+    listen [::]:80;
+    server_name airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+    return 404; # managed by Certbot
+}
+
+server {
+    if ($host = www.airlock6.com) {
+        return 301 https://airlocksix.com$request_uri;
+    } # managed by Certbot
+
+    listen 80;
+    listen [::]:80;
+    server_name www.airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+    return 404; # managed by Certbot
+}
+
diff --git a/etc/nginx/sites-available/airlocksix.com.conf.bootstrap b/etc/nginx/sites-available/airlocksix.com.conf.bootstrap
new file mode 100644
index 0000000..2042bd4
--- /dev/null
+++ b/etc/nginx/sites-available/airlocksix.com.conf.bootstrap
@@ -0,0 +1,58 @@
+# airlocksix.com
+# www.airlocksix.com
+# airlock6.com
+# www.airlock6.com
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name www.airlocksix.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location ~ /\.well-known {
+        allow all;
+    }
+
+    location ~ / {
+        return 301 $scheme://airlocksix.com$request_uri;
+    }
+}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name www.airlock6.com;
+    root /var/xyzzy/html/airlocksix;
+    index index.html;
+
+    location ~ /\.well-known {
+        allow all;
+    }
+
+    location ~ / {
+        return 301 $scheme://airlocksix.com$request_uri;
+    }
+}
diff --git a/html/airlocksix/.well-known/security.txt b/html/airlocksix/.well-known/security.txt
new file mode 100644
index 0000000..2934c3d
--- /dev/null
+++ b/html/airlocksix/.well-known/security.txt
@@ -0,0 +1 @@
+Contact: https://airlocksix.com
diff --git a/html/airlocksix/favicon.png b/html/airlocksix/favicon.png
new file mode 100644
index 0000000..5188754
Binary files /dev/null and b/html/airlocksix/favicon.png differ
diff --git a/html/airlocksix/favicon.svg b/html/airlocksix/favicon.svg
new file mode 100644
index 0000000..9dc9dcc
--- /dev/null
+++ b/html/airlocksix/favicon.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="256px" height="256px" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+ <g>
+  <path fill="none" d="M0 0h24v24H0z"/>
+  <path fill="#7a9d55" d="M14.886 2l-4.438 7.686A6.5 6.5 0 1 1 6.4 12.7L12.576 2h2.31zM12 11.5a4.5 4.5 0 1 0 0 9 4.5 4.5 0 0 0 0-9z"/>
+ </g>
+</svg>
diff --git a/html/airlocksix/index.css b/html/airlocksix/index.css
new file mode 100644
index 0000000..23c93c2
--- /dev/null
+++ b/html/airlocksix/index.css
@@ -0,0 +1,163 @@
+header,section{
+ display:block;
+}
+body{
+ font-size:16px;
+ margin:0 auto;
+ line-height:1.4;
+ background:#0b0c0d;
+ color:#d4d4d4;
+ font-family:"Noto Sans", Futura, Verdana, "Liberation Sans", sans-serif;
+}
+a{
+ color:#c79908;
+ text-decoration:none;
+}
+a:hover{
+ text-decoration:underline;
+}
+::selection {
+ color:#000;
+ background:#7a9e55;
+}
+h1{
+ font-size:2em;
+ margin:.67em 0;
+}
+kbd {
+ border-radius: 3px;
+ padding: 1px 2px 0;
+ border: 1px solid #666666;
+}
+#page{
+ position:relative;
+}
+#header{
+ padding-top:50px;
+ transform:translate3d(0,0,0);
+}
+.title-wrapper{
+ text-align:center;
+}
+.content{
+ margin-left:auto;
+ margin-right:auto;
+ padding:1px 20px;
+ position:relative;
+ z-index:2;
+ min-width:270px;
+}
+.title-group.animate{
+ animation:slide-fade-in .8s ease;
+}
+.title{
+ font-size:42px;
+ line-height:1.2;
+ margin:40px 0 0;
+ word-wrap:break-word;
+}
+.title a:active{
+ transform:translateY(1px);
+}
+.title a{
+ color:#e4e4e4;
+ display:block;
+ text-decoration:none;
+}
+.description{
+ color:#7a9e55;
+ margin:50px 0 0;
+ display:block;
+}
+.title+.description{
+ margin-top:10px!important;
+}
+.footdesc{
+ color:#666666;
+ margin:20px 0 0;
+ display:block;
+ font-size: 14px;
+}
+.footlink {
+  text-align: center;
+}
+.footlink.animate {
+  animation:slide-fade-in .8s ease;
+}
+.middle {
+  overflow: auto;
+  margin: auto;
+  display: inline;
+  text-align: center;
+  vertical-align: middle;
+}
+@media screen and (max-width:568px){
+ .content{
+  padding:1px 10px;
+ }
+ .title{
+  font-size:36px;
+  margin-top:30px;
+ }
+ .description{
+  margin-top:35px;
+  max-width:80%;
+  margin-left:auto;
+  margin-right:auto;
+ }
+ .title+.description{
+  margin-top:4px!important;
+ }
+}
+
+@keyframes slide-fade-in{
+ 0%{
+  opacity:0;
+  transform:translate3d(0,20px,0);
+ }
+ to{
+  opacity:1;
+  transform:translate3d(0,0,0);
+ }
+}
+
+.divTable {
+  font-size: 16px;
+  line-height: 2.0;
+  display: table;
+  margin: auto;
+  border: 1px solid #444;
+}
+.divTable.animate {
+  animation:slide-fade-in .8s ease;
+}
+.divTableRow {
+  display: table-row;
+}
+.divTableHeading {
+  display: table-header-group;
+  background-color: #ddd;
+}
+.divTableCell, .divTableHead {
+  vertical-align: middle;
+  display: table-cell;
+  padding: 5px 10px;
+  border: 1px solid #444;
+}
+.divTableHeading {
+  display: table-header-group;
+  background-color: #ddd;
+  font-weight: bold;
+}
+.divTableFoot {
+  display: table-footer-group;
+  font-weight: bold;
+  background-color: #ddd;
+}
+.divTableBody {
+  display: table-row-group;
+}
+.valign {
+  vertical-align: middle;
+}
+
diff --git a/html/airlocksix/index.html b/html/airlocksix/index.html
new file mode 100644
index 0000000..aba64ff
--- /dev/null
+++ b/html/airlocksix/index.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+ <meta charset="utf-8">
+ <title>airlock six</title>
+ <meta name="description" content="airlock six">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link rel="stylesheet" media="screen" href="index.css">
+ <link rel="icon" href="favicon.svg" type="image/svg+xml">
+ <link rel="alternate icon" href="favicon.png" type="image/png">
+</head>
+
+<body>
+
+ <header id="header">
+  <div class="title-wrapper content">
+   <div class="title-group">
+    <h1 class="title">airlock six</h1>
+    <span class="description">
+     <em>a personal domain</em>
+    </span>
+   </div>
+  </div>
+ </header>
+
+ <main id="main">
+  <div class="content middle">
+  </div>
+ </main>
+
+ <footer id="footer">
+  <div class="content middle">
+   <span class="footdesc">[ retreat to airlock ]</span>
+  </div>
+ </footer>
+
+</body>
+
+</html>
+
diff --git a/html/airlocksix/robots.txt b/html/airlocksix/robots.txt
new file mode 100644
index 0000000..8c3fe66
--- /dev/null
+++ b/html/airlocksix/robots.txt
@@ -0,0 +1,8 @@
+User-Agent: *
+
+# credit: jonty, asimov
+Disallow: /harming/humans
+Disallow: /ignoring/human/orders
+Disallow: /harm/to/self
+
+Allow: /