diff --git a/sys/vane/gall.hoon b/sys/vane/gall.hoon
index 4f30774f3d..d7d71030b0 100644
--- a/sys/vane/gall.hoon
+++ b/sys/vane/gall.hoon
@@ -1319,7 +1319,6 @@
         $ogre  `%c
         $perm  `%c
         $rest  `%b
-        $rule  `%e
         $serv  `%e
         $snap  `%j
         $them  `%e
@@ -1332,6 +1331,7 @@
         $request  `%l
         $serve    `%r
         $connect  `%r
+        $rule     `%r
       ==
     --
   --
diff --git a/sys/vane/rver.hoon b/sys/vane/rver.hoon
index bc6599685b..7a1491347d 100644
--- a/sys/vane/rver.hoon
+++ b/sys/vane/rver.hoon
@@ -110,6 +110,15 @@
       ::  channel-state: state managed by the +channel core
       ::
       =channel-state
+      ::  domains: domain-names that resolve to us
+      ::
+      domains=(set turf)
+      ::  http-config: our server configuration
+      ::
+      =http-config
+      ::  ports: live servers
+      ::
+      ports=[insecure=@ud secure=(unit @ud)]
   ==
 ::  +outstanding-connection: open http connections not fully complete:
 ::
@@ -1705,7 +1714,7 @@
     ;:  weld
       ::  hand back default configuration for now
       ::
-      [duct %give %set-config *http-config]~
+      [duct %give %set-config http-config.server-state.ax]~
     ::
       closed-connections
     ==
@@ -1713,15 +1722,42 @@
   ::
   =/  event-args  [[our eny duct now scry-gate] server-state.ax]
   =/  server  (per-server-event event-args)
-  ?-    -.task
   ::
-      ::  %live: notifies us of our running server config
-      ::
-      ::    [insecure-port=@ud secure-port=(unit @ud)]
+  ?-    -.task
+      ::  %live: notifies us of the ports of our live http servers
       ::
       %live
-    ~&  [%todo-live task]
+    =.  ports.server-state.ax  +.task
     [~ http-server-gate]
+      ::  %rule: updates our http configuration
+      ::
+      %rule
+    ?-  -.http-rule.task
+        ::  %cert: install tls certificate
+        ::
+        %cert
+      =*  config  http-config.server-state.ax
+      ?:  =(secure.config cert.http-rule.task)
+        [~ http-server-gate]
+      =.  secure.config  cert.http-rule.task
+      :_  http-server-gate
+      [duct %give %set-config config]~
+        ::  %turf: add or remove domain name
+        ::
+        %turf
+      =*  domains  domains.server-state.ax
+      =/  mod/(set turf)
+        ?:  ?=(%put action.http-rule.task)
+          (~(put in domains) turf.http-rule.task)
+        (~(del in domains) turf.http-rule.task)
+      ?:  =(domains mod)
+        [~ http-server-gate]
+      =.  domains  mod
+      :_  http-server-gate
+      =/  cmd
+        [%acme %poke `cage`[%acme-order !>(mod)]]
+      [duct %pass /acme/order %g %deal [our our] cmd]~
+    ==
   ::
       %request
     =^  moves  server-state.ax  (request:server +.task)
diff --git a/sys/zuse.hoon b/sys/zuse.hoon
index e3f80ecee0..da0d1c1851 100644
--- a/sys/zuse.hoon
+++ b/sys/zuse.hoon
@@ -928,10 +928,10 @@
   +=  http-rule
     $%  :: %cert: set or clear certificate and keypair
         ::
-        [%cert p=(unit [key=wain cert=wain])]
+        [%cert cert=(unit [key=wain cert=wain])]
         :: %turf: add or remove established dns binding
         ::
-        [%turf p=?(%put %del) q=turf]
+        [%turf action=?(%put %del) =turf]
     ==
   ++  httq                                              ::  raw http request
     $:  p/meth                                          ::  method
@@ -2240,9 +2240,12 @@
           ::  report upgrade
           ::
           [%vega ~]
-          ::  set http ports (?)
+          ::  notifies us of the ports of our live http servers
           ::
-          [%live p=@ud q=(unit @ud)]
+          [%live insecure=@ud secure=(unit @ud)]
+          ::  update http configuration
+          ::
+          [%rule =http-rule:eyre]
           ::  starts handling an inbound http request
           ::
           [%request secure=? =address =request:http]