diff -pruN 0.4-7/debian/changelog 0.5-1/debian/changelog
--- 0.4-7/debian/changelog	2018-09-12 03:50:01.000000000 +0000
+++ 0.5-1/debian/changelog	2022-01-31 17:56:12.000000000 +0000
@@ -1,3 +1,30 @@
+hddemux (0.5-1) unstable; urgency=medium
+
+  * new upstream version (all patches merged)
+   - enable cross-building (Closes: #928996)
+   - unset https_proxy during test suite (Closes: #918608)
+   - stop trying to use socket-activation for kresd
+     in test suite (Closes: #964055)
+  * Update standards version to 4.6.0, no changes needed.
+  * Set debhelper-compat version in Build-Depends.
+  * Re-export upstream signing key without extra signatures.
+  * Set upstream metadata fields: Repository.
+  * move to dh 13
+
+ -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 31 Jan 2022 12:56:12 -0500
+
+hddemux (0.4-8) unstable; urgency=medium
+
+  [ Julian Andres Klode ]
+  * avoid testsuite failure when https_proxy is set (Closes: #918608)
+
+  [ Daniel Kahn Gillmor ]
+  * move to debhelper 12
+  * standards-version: bump to 4.3.0 (no changes needed)
+  * link only as needed
+
+ -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 07 Jan 2019 16:37:07 -0500
+
 hddemux (0.4-7) unstable; urgency=medium
 
   [ Steve Langasek ]
diff -pruN 0.4-7/debian/compat 0.5-1/debian/compat
--- 0.4-7/debian/compat	2018-08-31 13:25:47.000000000 +0000
+++ 0.5-1/debian/compat	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-11
diff -pruN 0.4-7/debian/control 0.5-1/debian/control
--- 0.4-7/debian/control	2018-09-12 03:47:50.000000000 +0000
+++ 0.5-1/debian/control	2022-01-31 17:56:12.000000000 +0000
@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 Build-Depends:
  curl [!arm64] <!nocheck>,
- debhelper (>= 11~),
+ debhelper-compat (= 13),
  gnutls-bin [!arm64] <!nocheck>,
  knot-dnsutils [!arm64] <!nocheck>,
  knot-resolver [!arm64 !s390x] <!nocheck>,
@@ -14,8 +14,8 @@ Build-Depends:
  pandoc,
  pkg-config,
  systemd [!arm64] <!nocheck>,
-Standards-Version: 4.2.1
-Vcs-Git: https://salsa.debian.org/debian/hddemux.git -b debian/master
+Standards-Version: 4.6.0
+Vcs-Git: https://salsa.debian.org/debian/hddemux.git -b debian/main
 Vcs-Browser: https://salsa.debian.org/debian/hddemux
 Homepage: https://0xacab.org/dkg/hddemux
 Rules-Requires-Root: no
diff -pruN 0.4-7/debian/gbp.conf 0.5-1/debian/gbp.conf
--- 0.4-7/debian/gbp.conf	2018-08-31 13:25:47.000000000 +0000
+++ 0.5-1/debian/gbp.conf	2022-01-31 17:56:12.000000000 +0000
@@ -1,3 +1,3 @@
 [DEFAULT]
-debian-branch = debian/master
+debian-branch = debian/main
 upstream-tag = hddemux-%(version)s
diff -pruN 0.4-7/debian/patches/0001-display-what-goes-wrong-with-the-daemons-at-the-end-.patch 0.5-1/debian/patches/0001-display-what-goes-wrong-with-the-daemons-at-the-end-.patch
--- 0.4-7/debian/patches/0001-display-what-goes-wrong-with-the-daemons-at-the-end-.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0001-display-what-goes-wrong-with-the-daemons-at-the-end-.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Thu, 30 Aug 2018 09:24:25 -0400
-Subject: display what goes wrong with the daemons at the end of the test
- suite
-
----
- testsuite | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/testsuite b/testsuite
-index b654557..fb7bded 100755
---- a/testsuite
-+++ b/testsuite
-@@ -49,6 +49,7 @@ section() {
- 
- cleanup () {
-     section "cleaning up"
-+    tail "$d/"*.err
-     /usr/sbin/nginx -c "$d/nginx.conf" -p "$d" -s stop 2> "$d/nginx-stop.err" || true
-     kill %2 || true
-     kill %1 || true
diff -pruN 0.4-7/debian/patches/0002-testsuite-choose-a-random-loopback-IP-address-to-wor.patch 0.5-1/debian/patches/0002-testsuite-choose-a-random-loopback-IP-address-to-wor.patch
--- 0.4-7/debian/patches/0002-testsuite-choose-a-random-loopback-IP-address-to-wor.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0002-testsuite-choose-a-random-loopback-IP-address-to-wor.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,30 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Thu, 30 Aug 2018 09:25:13 -0400
-Subject: testsuite: choose a random loopback IP address to work on
-
----
- testsuite | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/testsuite b/testsuite
-index fb7bded..69fa0d6 100755
---- a/testsuite
-+++ b/testsuite
-@@ -17,7 +17,7 @@
- #             if it already exists, it will not be cleaned up.
- #  -  TESTIP: the IP address to use for testing.
- #             the user needs to be able to open listening sockets, and to connect to them
--#             by default, 127.7.8.9
-+#             by default, choose a random IP in 127.0.0.0/8
- 
- # Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
- # 2018-08-29
-@@ -38,7 +38,7 @@ if [ -z "$WORKDIR" ]; then
- else
-     d="$WORKDIR"
- fi
--ip="${TESTIP:-127.7.8.9}"
-+ip="${TESTIP:-127.$(( $RANDOM % 256 )).$(( $RANDOM % 256 )).$(( $RANDOM % 256 ))}"
- 
- printf "hddemux test\n------------\n  binary: %s\n workdir: %s\n IP addr: %s\n" "$hddemux" "$d" "$ip"
- 
diff -pruN 0.4-7/debian/patches/0003-be-more-verbose-during-testsuite-termination.patch 0.5-1/debian/patches/0003-be-more-verbose-during-testsuite-termination.patch
--- 0.4-7/debian/patches/0003-be-more-verbose-during-testsuite-termination.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0003-be-more-verbose-during-testsuite-termination.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,20 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Thu, 30 Aug 2018 10:08:52 -0400
-Subject: be more verbose during testsuite termination
-
----
- testsuite | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/testsuite b/testsuite
-index 69fa0d6..eba730d 100755
---- a/testsuite
-+++ b/testsuite
-@@ -49,6 +49,7 @@ section() {
- 
- cleanup () {
-     section "cleaning up"
-+    find "$d" -ls
-     tail "$d/"*.err
-     /usr/sbin/nginx -c "$d/nginx.conf" -p "$d" -s stop 2> "$d/nginx-stop.err" || true
-     kill %2 || true
diff -pruN 0.4-7/debian/patches/0004-avoid-emerg-8878-8878-mkdir-var-lib-nginx-body-faile.patch 0.5-1/debian/patches/0004-avoid-emerg-8878-8878-mkdir-var-lib-nginx-body-faile.patch
--- 0.4-7/debian/patches/0004-avoid-emerg-8878-8878-mkdir-var-lib-nginx-body-faile.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0004-avoid-emerg-8878-8878-mkdir-var-lib-nginx-body-faile.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Thu, 30 Aug 2018 10:09:19 -0400
-Subject: avoid [emerg] 8878#8878: mkdir() "/var/lib/nginx/body" failed (13:
- Permission denied)
-
----
- testsuite | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/testsuite b/testsuite
-index eba730d..a65f1db 100755
---- a/testsuite
-+++ b/testsuite
-@@ -120,6 +120,7 @@ http {
-  default_type text/plain;
-  ssl_protocols TLSv1.2;
-  ssl_prefer_server_ciphers on;
-+ client_body_temp_path body;
-  server {
-   listen $ip:4433 ssl;
-   server_name test.example;
diff -pruN 0.4-7/debian/patches/0005-testsuite-handle-other-nginx-temp_path-vars.patch 0.5-1/debian/patches/0005-testsuite-handle-other-nginx-temp_path-vars.patch
--- 0.4-7/debian/patches/0005-testsuite-handle-other-nginx-temp_path-vars.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0005-testsuite-handle-other-nginx-temp_path-vars.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,33 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Thu, 30 Aug 2018 11:43:21 -0400
-Subject: testsuite: handle other nginx temp_path vars
-
----
- testsuite | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/testsuite b/testsuite
-index a65f1db..30f5fbe 100755
---- a/testsuite
-+++ b/testsuite
-@@ -108,6 +108,7 @@ section "make hddeumx configuration on $ip:2000"
- systemd-socket-activate -l "$ip:2000" -E=HTTP_TARGET="$ip:8853" -E DNS_TARGET="$ip:8853" "$hddemux" 2> "$d/hddemux.err" &
- 
- section "set up nginx on $ip:4433"
-+mkdir -p "$d/nginx"
- cat >"$d/nginx.conf" <<EOF
- error_log stderr;
- worker_processes 1;
-@@ -120,7 +121,11 @@ http {
-  default_type text/plain;
-  ssl_protocols TLSv1.2;
-  ssl_prefer_server_ciphers on;
-- client_body_temp_path body;
-+ client_body_temp_path nginx/body;
-+ fastcgi_temp_path nginx/fastcgi;
-+ proxy_temp_path nginx/proxy;
-+ scgi_temp_path nginx/scgi;
-+ uwsgi_temp_path nginx/uwsgi;
-  server {
-   listen $ip:4433 ssl;
-   server_name test.example;
diff -pruN 0.4-7/debian/patches/0006-testsuite-send-expected-stderr-to-stdout.patch 0.5-1/debian/patches/0006-testsuite-send-expected-stderr-to-stdout.patch
--- 0.4-7/debian/patches/0006-testsuite-send-expected-stderr-to-stdout.patch	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/0006-testsuite-send-expected-stderr-to-stdout.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-Date: Fri, 31 Aug 2018 09:26:38 -0400
-Subject: testsuite: send expected stderr to stdout
-
----
- testsuite | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/testsuite b/testsuite
-index 30f5fbe..bc15db4 100755
---- a/testsuite
-+++ b/testsuite
-@@ -65,7 +65,7 @@ trap cleanup EXIT
- 
- section "simple failing run"
- # hddemux with no arguments and no listening file descriptors should fail:
--if "$hddemux"; then
-+if "$hddemux" 2>&1; then
-     false
- fi
- 
diff -pruN 0.4-7/debian/patches/series 0.5-1/debian/patches/series
--- 0.4-7/debian/patches/series	2018-08-31 13:26:57.000000000 +0000
+++ 0.5-1/debian/patches/series	1970-01-01 00:00:00.000000000 +0000
@@ -1,6 +0,0 @@
-0001-display-what-goes-wrong-with-the-daemons-at-the-end-.patch
-0002-testsuite-choose-a-random-loopback-IP-address-to-wor.patch
-0003-be-more-verbose-during-testsuite-termination.patch
-0004-avoid-emerg-8878-8878-mkdir-var-lib-nginx-body-faile.patch
-0005-testsuite-handle-other-nginx-temp_path-vars.patch
-0006-testsuite-send-expected-stderr-to-stdout.patch
diff -pruN 0.4-7/debian/upstream/metadata 0.5-1/debian/upstream/metadata
--- 0.4-7/debian/upstream/metadata	1970-01-01 00:00:00.000000000 +0000
+++ 0.5-1/debian/upstream/metadata	2022-01-31 17:56:12.000000000 +0000
@@ -0,0 +1,3 @@
+Repository: https://0xacab.org/dkg/hddemux
+Bug-Database: https://0xacab.org/dkg/hddemux/-/issues
+Bug-Submit: https://0xacab.org/dkg/hddemux/-/issues/new
diff -pruN 0.4-7/debian/upstream/signing-key.asc 0.5-1/debian/upstream/signing-key.asc
--- 0.4-7/debian/upstream/signing-key.asc	2018-08-31 13:25:47.000000000 +0000
+++ 0.5-1/debian/upstream/signing-key.asc	2022-01-31 17:56:12.000000000 +0000
@@ -24,41 +24,6 @@ BId/2UmHu6OuYoMFYV2QGZkOehRNwKKCRaAtqtZ7
 oeQNzbi+D1FHbx63EEb7wQL8GPml6jbdSCZNE6OfheFNvlhxaHTLr2spmXb+ln8E
 Yr+lpsL0bZoXU4QSL2zLF+gum2cdeh5aacKjlXc1qNUUSpL3L6VFL5tLkcwsen0e
 l8+jqi8QLLbkbcrzRrE9KyUWY2gslxwg1vuatrDEZgTN2sPiO9bFs0pGZRETZHHi
-mlgM1EDH/KI1Nhy0bJ7jnZYUF7hduQINBFhakQQBEADN04DB9aitesgp6dcLZnRL
-PYLYPizcIyYtlfzqRHDIXqRdxiycimjywv7IDkb1DkdalPsOftXodl3i/vNBgwKK
-FyFAfRX8kBuRnqdGT3EyG2/FYAz5NdpqPz5BVx+lAdA8ftjgeHZhtWI6/N8DRWUk
-JHsNE6iIJdrXhvgvPdoOEfQXh0oplEExGnqgG4YZcyySUApbNGf3bJhYKHvJMBvz
-whBdOSgTHAuD+CVCVLntZeeD43UhTFyYCb1/mZseZC6d1eJlsqG7eues+hDFcTfM
-3HdPiSdT+qCa+coutI3XPoiqkcWBPxOQkH1ghhif9qEC1Wyj1/DudiUbwhTnbIwv
-FiVruHOhZVp/BYFhjENAh5AYqOHdrytMwLCBNmdfj5Qd9/JAVmL9FCbNgcMnfTnk
-9wHMuhriJF5m5rF+oOKg+j+JMwxAtx7l/Mj/qE7XlQlugS0u+6vgcSlgaxIbvzKT
-gnVAxygYvYcZAMS2R+4bZL4Zd/v8bvlUL0lzSwMwFaQnZR/phxu8J6IqlCbcBunY
-gFQ/kGewTyc9YbtdI4KPRrrxkDjbEEluQyG61bGNnSpEUOBHpKp+qZ/WBvnY+6rk
-HURwg752g1jGMhq4kXBcF2AXArWrNNMFIJ/Q+iCbSRkqnB68mGGbrrg3mnclPQF6
-Xl3M/w7ZRW1eH6rE3Y078wARAQABiQRyBBgBCgAmFiEEDuW+l5KC2AufdUDxzNLt
-lNIXOekFAlhakQQCGwIFCQHhM4ACQAkQzNLtlNIXOenBdCAEGQEKAB0WIQQ4J2BR
-6kd/o+SVOTIUmK3GwZIyNwUCWFqRBAAKCRAUmK3GwZIyN8dED/4x4ulk/Ww9ySTy
-ZY8B0grhyKE8A99k1k+exsS/K8wZgN1jZcfsbQBN4FcR2RsEguh+p6eyg1KUWKO8
-yKbYDACFCIM8hxxWoylt2tCcxluypKK0yAQPM5te14Oh2jQzojoPj7S2Rqg3BQf9
-QFQjTc97zOMjMdNFgyKnFN2cgwHctpdSCYZxvAR/oOKEmKgLCiognff1wn9x+8yy
-qMS0FRu+vgFAOXvtO/weB8kwFZn3g29WqfoLRl/OyJx9r82IQHQsrIm7stDOEn2k
-cnLKcOPkHeaoKohp0t676yYINAVlQJc4OmqVS4EkprU5pp+sfjD67CUGjK99tcap
-67jdBcEthDR+tZQdHqJoOgDY/fhOuyRgb3aPItNaHHIYkJkLSV1NyXkDbv527/3x
-zMuwKiq/a5aJFnBPBoE1OcGeDnlmfljxQJEeSTGMv45tYEYud8sAkWowHs0597FE
-nOMQ3/IPfzxAlFACU+AMNVHJfyUQ5VZaCZRpcKnKQNrsd3RCqQLwgbzffIMuP7iJ
-lFxSUNSef95sURipMfYQ0BZdh1r+SeSdVkLgKyfBsJSarUTQM86RdcWj9+ClIBlm
-wE4FCMtmYTYVH4kkNacZS/G5I6LWFNmzph+83y6vx8r0f9fK8upopLF3DM2xEeuw
-QCVIWCMQKqcFj5pAWhVqiRIEZ7oOGlBeEACdgmqdUHqeYNABq50pA4ssXKTDBH1H
-UvCtcQuni5dIeJcdeD9ISW9GRAdfXwurmMpRF1XGTrwUxQBKlljAI5VDR4Pq8UMj
-yld+AYpV9DnpLDcWAi53EycuLWpA6IkIOg2Z4qe5/aOUHsKkFg7Psc3laMBCRcCu
-fZ9yFVfz6TXPwXRMTukPJtQEViLT0bkLMHNlxkQ0+GCreh6+WkfVPEg4BBHPA8BA
-u7wFT7Emz5EI/KyTCqeLZDxfi2DBzhv+zTbx11YWGMSU6wvRGFzfBITFzhcHqFpU
-fD2YgZkigAVizUzv9ruc0tUFaCFn3z6FmMhOwlgnXa7zFi9L4gg14dEaUePZnwa4
-MTzKIeKZ8KMlzSedi2pH89qhKYx7V/DkC65xW/7N3q9vk3WG4U9iYNnt3yLHrfsO
-2vai/vCB9QHgNjGZrNWKu2T856fMlaKMDtbOvOTiVdv1uat6e66u4HM6Uc/8J07O
-MIpQUjxwKxGTsPzRDW5a9o2xbcZLpO31UQLoijg/IyS+WfOEEhmhz1xfl9RoIsmy
-JJQTTC3Sl7C9mj3Mh8nVFFAhiPu+eJqLBTPLFHREpQFgBoZ8IluIYpIhxhTtSgTw
-wSlRYF6dvaOaojvviWuGIfO/73k4a/NLevWKUPt09CB6Ga696R6JjIHEY8MGXt0U
-8u1xHpIMhDEDqA==
-=aMC3
+mlgM1EDH/KI1Nhy0bJ7jnZYUF7hd
+=7M1k
 -----END PGP PUBLIC KEY BLOCK-----
diff -pruN 0.4-7/debian/watch 0.5-1/debian/watch
--- 0.4-7/debian/watch	1970-01-01 00:00:00.000000000 +0000
+++ 0.5-1/debian/watch	2022-01-31 17:56:12.000000000 +0000
@@ -0,0 +1,2 @@
+version=4
+ https://0xacab.org/dkg/hddemux/tags .*/hddemux-hddemux-([\d.]*)\.tar\.gz
diff -pruN 0.4-7/Makefile 0.5-1/Makefile
--- 0.4-7/Makefile	2018-08-29 20:58:30.000000000 +0000
+++ 0.5-1/Makefile	2022-01-31 19:38:36.000000000 +0000
@@ -2,10 +2,11 @@
 
 CFLAGS += -D_GNU_SOURCE -g -O3
 
-CFLAGS += $(shell pkg-config --cflags libuv)
-CFLAGS += $(shell pkg-config --cflags libsystemd)
-LDFLAGS += $(shell pkg-config --libs libuv)
-LDFLAGS += $(shell pkg-config --libs libsystemd)
+PKG_CONFIG ?= pkg-config
+CFLAGS += $(shell $(PKG_CONFIG) --cflags libuv)
+CFLAGS += $(shell $(PKG_CONFIG) --cflags libsystemd)
+LDFLAGS += $(shell $(PKG_CONFIG) --libs libuv)
+LDFLAGS += $(shell $(PKG_CONFIG) --libs libsystemd)
 
 all: hddemux hddemux.1
 
@@ -13,7 +14,7 @@ check: hddemux
 	PATH=.:$$PATH ./testsuite
 
 hddemux: hddemux.c
-	gcc $(CPPFLAGS) $(CFLAGS) $< $(LDFLAGS) -std=c11 -pedantic -Wall -Werror -o $@
+	$(CC) $(CPPFLAGS) $(CFLAGS) $< -Wl,--as-needed $(LDFLAGS) -std=c11 -pedantic -Wall -Werror -o $@
 
 hddemux.1: hddemux.1.md
 	pandoc -s -f markdown -t man -o $@ $<
diff -pruN 0.4-7/testsuite 0.5-1/testsuite
--- 0.4-7/testsuite	2018-08-29 20:58:30.000000000 +0000
+++ 0.5-1/testsuite	2022-01-31 19:38:36.000000000 +0000
@@ -17,7 +17,7 @@
 #             if it already exists, it will not be cleaned up.
 #  -  TESTIP: the IP address to use for testing.
 #             the user needs to be able to open listening sockets, and to connect to them
-#             by default, 127.7.8.9
+#             by default, choose a random IP in 127.0.0.0/8
 
 # Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 # 2018-08-29
@@ -28,6 +28,9 @@ set -e
 # for handling jobspecs:
 set -m
 
+# Unset proxy to make sure curl behaves correctly
+unset https_proxy http_proxy
+
 hddemux=$(which hddemux) || hddemux=./hddemux
 
 [ -x "$hddemux" ]
@@ -38,7 +41,7 @@ if [ -z "$WORKDIR" ]; then
 else
     d="$WORKDIR"
 fi
-ip="${TESTIP:-127.7.8.9}"
+ip="${TESTIP:-127.$(( $RANDOM % 256 )).$(( $RANDOM % 256 )).$(( $RANDOM % 256 ))}"
 
 printf "hddemux test\n------------\n  binary: %s\n workdir: %s\n IP addr: %s\n" "$hddemux" "$d" "$ip"
 
@@ -49,6 +52,8 @@ section() {
 
 cleanup () {
     section "cleaning up"
+    find "$d" -ls
+    tail "$d/"*.err
     /usr/sbin/nginx -c "$d/nginx.conf" -p "$d" -s stop 2> "$d/nginx-stop.err" || true
     kill %2 || true
     kill %1 || true
@@ -63,7 +68,7 @@ trap cleanup EXIT
 
 section "simple failing run"
 # hddemux with no arguments and no listening file descriptors should fail:
-if "$hddemux"; then
+if "$hddemux" 2>&1; then
     false
 fi
 
@@ -100,13 +105,15 @@ modules = { 'hints > iterate' }
 net.tls("$d/ee-cert.pem", "$d/ee-key.pem")
 hints["monkeys.example"] = "127.15.23.5"
 EOF
-systemd-socket-activate -l "$ip:8853" --fdname=tls /usr/sbin/kresd -c "$d/kresd.conf" "$d" 2> "$d/kresd.err" &
+/usr/sbin/kresd --config "$d/kresd.conf" --tls "$ip@8853" --noninteractive "$d" 2> "$d/kresd.err" &
 
-section "make hddeumx configuration on $ip:2000"
-systemd-socket-activate -l "$ip:2000" -E=HTTP_TARGET="$ip:8853" -E DNS_TARGET="$ip:8853" "$hddemux" 2> "$d/hddemux.err" &
+section "make hddemux configuration on $ip:2000"
+systemd-socket-activate -l "$ip:2000" -E HTTP_TARGET="$ip:8853" -E DNS_TARGET="$ip:8853" "$hddemux" 2> "$d/hddemux.err" &
 
 section "set up nginx on $ip:4433"
+mkdir -p "$d/nginx"
 cat >"$d/nginx.conf" <<EOF
+# note: an alert might still show up: https://trac.nginx.org/nginx/ticket/147
 error_log stderr;
 worker_processes 1;
 pid nginx.pid;
@@ -118,6 +125,11 @@ http {
  default_type text/plain;
  ssl_protocols TLSv1.2;
  ssl_prefer_server_ciphers on;
+ client_body_temp_path nginx/body;
+ fastcgi_temp_path nginx/fastcgi;
+ proxy_temp_path nginx/proxy;
+ scgi_temp_path nginx/scgi;
+ uwsgi_temp_path nginx/uwsgi;
  server {
   listen $ip:4433 ssl;
   server_name test.example;
