diff --git a/image-entry.d/00-common.envsh b/image-entry.d/00-common.envsh
index 9449983..1e683ce 100644
--- a/image-entry.d/00-common.envsh
+++ b/image-entry.d/00-common.envsh
@@ -47,7 +47,6 @@ log_always() {
 log() {
 	[ "${IEP_VERBOSE}" = 0 ] || log_always "$@"
 }
-log_file() { sed -E '/^./s,^,  ,' < "$1" >&2 ; }
 
 ln_s() {
 	if [ "${IEP_VERBOSE}" = 0 ] ; then
@@ -76,39 +75,6 @@ have_cmd() { command -v "$1" >/dev/null 2>&1 || return ; }
 
 strip_suffix() { printf '%s' "${1%"$2"}" | tr -s '/' ; }
 
-untemplate_path() {
-	case "$1" in
-	## inplace
-	"${volume_root}"/* | /etc/angie/run/* )
-		strip_suffix "$1" "$2"
-	;;
-	/etc/angie/autoconf.d/* | /etc/angie/conf.d/* | /etc/angie/j2cfg.d/* | /etc/angie/mod.d/* | /etc/angie/modules.d/* | /etc/angie/site.d/* | /etc/angie/snip.d/* )
-		strip_suffix "$1" "$2"
-	;;
-	/etc/angie/static.d/* )
-		strip_suffix "$1" "$2"
-	;;
-	## set appropriate location
-	/etc/angie/* )
-		strip_suffix "${volume_root}${1#/etc/angie}" "$2"
-	;;
-	/tmp/* )
-		log_always "untemplate_path() shouldn't work with /tmp/: $1"
-		strip_suffix "$1" "$2"
-	;;
-	## last resort - STRONGLY AVOID
-	/* )
-		log_always "untemplate_path() does uncommon/last-resort mapping for: $1"
-		strip_suffix "${tmp_dir}$1" "$2"
-	;;
-	## misbehavior!
-	* )
-		log_always "untemplate_path() doesn't work with relative paths: $1"
-		return 1
-	;;
-	esac
-}
-
 install_userdir() {
 	if [ "${IEP_ROOT}" = 1 ] ; then
 		install -d -o "${NGX_USER}" -g "${NGX_GROUP}" "$@"
@@ -208,69 +174,6 @@ expand_dir_j2cfg() {
 	return ${__ret}
 }
 
-remap_path() {
-	[ -n "$1" ] || return
-
-	case "$1" in
-	## autoconf
-	/etc/angie/autoconf.dist/* ) echo "${2:-/etc/angie/autoconf.d}${1#/etc/angie/autoconf.dist}" ;;
-	/etc/angie/autoconf/* )      echo "${2:-/etc/angie/autoconf.d}${1#/etc/angie/autoconf}" ;;
-	/angie/autoconf/* )          echo "${2:-/etc/angie/autoconf.d}${1#/angie/autoconf}" ;;
-	## conf
-	/etc/angie/conf.dist/* ) echo "${2:-/etc/angie/conf.d}${1#/etc/angie/conf.dist}" ;;
-	/etc/angie/conf/* )      echo "${2:-/etc/angie/conf.d}${1#/etc/angie/conf}" ;;
-	/angie/conf/* )          echo "${2:-/etc/angie/conf.d}${1#/angie/conf}" ;;
-	## j2cfg
-	/etc/angie/j2cfg.dist/* ) echo "${2:-/etc/angie/j2cfg.d}${1#/etc/angie/j2cfg.dist}" ;;
-	/etc/angie/j2cfg/* )      echo "${2:-/etc/angie/j2cfg.d}${1#/etc/angie/j2cfg}" ;;
-	/angie/j2cfg/* )          echo "${2:-/etc/angie/j2cfg.d}${1#/angie/j2cfg}" ;;
-	## mod
-	/etc/angie/mod.dist/* ) echo "${2:-/etc/angie/mod.d}${1#/etc/angie/mod.dist}" ;;
-	/etc/angie/mod/* )      echo "${2:-/etc/angie/mod.d}${1#/etc/angie/mod}" ;;
-	/angie/mod/* )          echo "${2:-/etc/angie/mod.d}${1#/angie/mod}" ;;
-	## modules
-	/etc/angie/modules.dist/* ) echo "${2:-/etc/angie/modules.d}${1#/etc/angie/modules.dist}" ;;
-	/etc/angie/modules/* )      echo "${2:-/etc/angie/modules.d}${1#/etc/angie/modules}" ;;
-	/angie/modules/* )          echo "${2:-/etc/angie/modules.d}${1#/angie/modules}" ;;
-	## site
-	/etc/angie/site.dist/* ) echo "${2:-/etc/angie/site.d}${1#/etc/angie/site.dist}" ;;
-	/etc/angie/site/* )      echo "${2:-/etc/angie/site.d}${1#/etc/angie/site}" ;;
-	/angie/site/* )          echo "${2:-/etc/angie/site.d}${1#/angie/site}" ;;
-	## snip
-	/etc/angie/snip.dist/* ) echo "${2:-/etc/angie/snip.d}${1#/etc/angie/snip.dist}" ;;
-	/etc/angie/snip/* )      echo "${2:-/etc/angie/snip.d}${1#/etc/angie/snip}" ;;
-	/angie/snip/* )          echo "${2:-/etc/angie/snip.d}${1#/angie/snip}" ;;
-
-	## static
-	/etc/angie/static.dist/* ) echo "${2:-/etc/angie/static.d}${1#/etc/angie/static.dist}" ;;
-	/etc/angie/static/* )      echo "${2:-/etc/angie/static.d}${1#/etc/angie/static}" ;;
-	/angie/static/* )          echo "${2:-/etc/angie/static.d}${1#/angie/static}" ;;
-
-	## log
-	/etc/angie/log.dist/* ) echo "${2:-/etc/angie/log.d}${1#/etc/angie/log.dist}" ;;
-	/angie/log/* )          echo "${2:-/etc/angie/log.d}${1#/angie/log}" ;;
-
-	## misbehavior!
-	* )
-		log_always "remap_path() doesn't know how to handle this path: $1"
-		return 1
-	;;
-	esac
-}
-
-combine_remap_path() {
-	[ -n "$1" ] || return
-
-	case "$1" in
-	"${merged_root}"/* ) echo "${2:-${target_root}}${1#"${merged_root}"}" ;;
-	## misbehavior!
-	* )
-		log_always "combine_remap_path() doesn't know how to handle this path: $1"
-		return 1
-	;;
-	esac
-}
-
 is_builtin_module() {
 	[ -n "${1:-}" ] || return 1
 	[ -n "${2:-}" ] || return 1
@@ -281,6 +184,30 @@ is_builtin_module() {
 	grep -Fxq -e "$2" "/etc/angie/builtin.$1" || return 1
 }
 
+append_list() {
+	if [ -n "$2" ] ; then
+		printf '%s' "${1:-}${1:+ }$2"
+	else
+		printf '%s' "$1"
+	fi
+}
+
+prepend_list() {
+	if [ -n "$2" ] ; then
+		printf '%s' "$2${1:+ }${1:-}"
+	else
+		printf '%s' "$1"
+	fi
+}
+
+list_have_item() {
+	[ -n "$2" ] || return 1
+	case " $1 " in
+	*" $2 "* ) return 0 ;;
+	* )        return 1 ;;
+	esac
+}
+
 normalize_list() {
 	[ -n "$1" ] || return 0
 
@@ -296,3 +223,7 @@ sort_dedup_list() {
 	| tr -s '[:space:]' '\n' | sort -uV | paste -sd ' ' \
 	| sed -zE 's/^\s+//;s/\s+$//'
 }
+
+float_div() {
+	mawk -v "a=$1" -v "b=$2" 'BEGIN{print a/b;exit;}' </dev/null
+}
diff --git a/image-entry.d/01-defaults.envsh b/image-entry.d/01-defaults.envsh
index e62c8f5..f10e867 100755
--- a/image-entry.d/01-defaults.envsh
+++ b/image-entry.d/01-defaults.envsh
@@ -28,29 +28,46 @@ else
 	NGX_DIRS_LINK="${NGX_DIRS_LINK:-} static"
 fi
 
-set -a
 NGX_DIRS_MERGE=$(sort_dedup_list "${default_dirs_merge} ${NGX_DIRS_MERGE:-}")
 NGX_DIRS_LINK=$(sort_dedup_list "${default_dirs_link} ${NGX_DIRS_LINK:-}")
-set +a
 
 unset default_dirs_merge default_dirs_link
 
-unset i dirs_link
-dirs_link=
-for i in ${NGX_DIRS_LINK:-} ; do
+unset i dirs
+
+dirs=
+for i in ${NGX_DIRS_MERGE:-} ; do
 	[ -n "$i" ] || continue
 
-	## naive deduplication
-	case " ${NGX_DIRS_MERGE} " in
-	*" $i "* )
-		log "$i is already specified in NGX_DIRS_MERGE - removing from NGX_DIRS_LINK"
+	case "$i" in
+	/* | */.* | *./* | *\** | *\?* )
+		log_always "NGX_DIRS_MERGE: dir '$i' is not legal, skipping"
 		continue
 	;;
 	esac
 
-	dirs_link="${dirs_link}${dirs_link:+ }$i"
+	dirs=$(append_list "${dirs}" "$i")
 done
-unset i
+export NGX_DIRS_MERGE="${dirs}"
 
-export NGX_DIRS_LINK="${dirs_link}"
-unset dirs_link
+dirs=
+for i in ${NGX_DIRS_LINK:-} ; do
+	[ -n "$i" ] || continue
+
+	case "$i" in
+	/* | */.* | *./* | *\** | *\?* )
+		log_always "NGX_DIRS_LINK: dir '$i' is not legal, skipping"
+		continue
+	;;
+	esac
+
+	if list_have_item "${NGX_DIRS_MERGE}" "$i" ; then
+		log "$i is already specified in NGX_DIRS_MERGE - removing from NGX_DIRS_LINK"
+		continue
+	fi
+
+	dirs=$(append_list "${dirs}" "$i")
+done
+export NGX_DIRS_LINK="${dirs}"
+
+unset i dirs
diff --git a/image-entry.d/04-local-ip-addresses.envsh b/image-entry.d/04-local-ip-addresses.envsh
index bd4a1d6..10bb06b 100755
--- a/image-entry.d/04-local-ip-addresses.envsh
+++ b/image-entry.d/04-local-ip-addresses.envsh
@@ -6,17 +6,17 @@
 if [ -z "${NGX_IP_ADDRESSES:-}" ] ; then
 	NGX_IP_ADDRESSES=$(hostname -I)
 fi
-NGX_IP_ADDRESSES=$(printf '%s' "${NGX_IP_ADDRESSES}" | sed -zE 's/^\s+//;s/\s+$//;s/\s+/ /g')
+NGX_IP_ADDRESSES=$(normalize_list "${NGX_IP_ADDRESSES}")
 export NGX_IP_ADDRESSES
 
 unset NGX_IPV4_ADDRESSES NGX_IPV6_ADDRESSES
 for i in ${NGX_IP_ADDRESSES} ; do
 	case "$i" in
 	*:* )
-		NGX_IPV6_ADDRESSES="${NGX_IPV6_ADDRESSES:-}${NGX_IPV6_ADDRESSES:+ }$i"
+		NGX_IPV6_ADDRESSES=$(append_list "${NGX_IPV6_ADDRESSES}" "$i")
 	;;
 	* )
-		NGX_IPV4_ADDRESSES="${NGX_IPV4_ADDRESSES:-}${NGX_IPV4_ADDRESSES:+ }$i"
+		NGX_IPV4_ADDRESSES=$(append_list "${NGX_IPV4_ADDRESSES}" "$i")
 	;;
 	esac
 done
diff --git a/image-entry.d/11-core-modules.envsh b/image-entry.d/11-core-modules.envsh
index f10ace9..330ef13 100755
--- a/image-entry.d/11-core-modules.envsh
+++ b/image-entry.d/11-core-modules.envsh
@@ -18,19 +18,17 @@ for i in ${NGX_CORE_MODULES:-} ; do
 
 	if is_builtin_module core "$i" ; then
 		log "$i is builtin module, moving to NGX_CORE_CONFLOAD"
-		core_confload="${core_confload} $i"
+		core_confload=$(append_list "${core_confload}" "$i")
 		continue
 	fi
 
 	## naive deduplication
-	case " ${core_modules} " in
-	*" $i "* )
+	if list_have_item "${core_modules}" "$i" ; then
 		log "$i is already specified"
 		continue
-	;;
-	esac
+	fi
 
-	core_modules="${core_modules}${core_modules:+ }$i"
+	core_modules=$(append_list "${core_modules}" "$i")
 done
 unset i
 
diff --git a/image-entry.d/13-core-worker.envsh b/image-entry.d/13-core-worker.envsh
index 8fa9412..fdb7697 100755
--- a/image-entry.d/13-core-worker.envsh
+++ b/image-entry.d/13-core-worker.envsh
@@ -182,7 +182,7 @@ fi
 if [ ${nofile_limit} -lt ${NGX_WORKER_CONNECTIONS} ] ; then
 	log_always "WARNING: ${nofile_kind} is less than NGX_WORKER_CONNECTIONS (${nofile_limit} < ${NGX_WORKER_CONNECTIONS})"
 else
-	ratio=$(mawk -v "a=${nofile_limit}" -v "b=${NGX_WORKER_CONNECTIONS}" 'BEGIN{print a/b;exit;}' </dev/null)
+	ratio=$(float_div "${nofile_limit}" "${NGX_WORKER_CONNECTIONS}")
 	case "${ratio}" in
 	1 | 1.* )
 		log_always "WARNING: \"${nofile_kind}/NGX_WORKER_CONNECTIONS\" ratio is too low (=${ratio})"
diff --git a/image-entry.d/21-http-modules.envsh b/image-entry.d/21-http-modules.envsh
index b844857..3154fde 100755
--- a/image-entry.d/21-http-modules.envsh
+++ b/image-entry.d/21-http-modules.envsh
@@ -1,6 +1,8 @@
 #!/bin/sh
 
-if [ "${NGX_HTTP}" = 1 ] ; then
+if [ "${NGX_HTTP}" = 0 ] ; then
+	unset NGX_HTTP_NO_PROXY NGX_HTTP_WITH_MODSECURITY
+else
 	unset http_modules http_confload
 	http_modules=
 	http_confload="${NGX_HTTP_CONFLOAD:-}"
@@ -8,6 +10,18 @@ if [ "${NGX_HTTP}" = 1 ] ; then
 	if [ -n "${NGX_HTTP_MODULES}" ] ; then
 		## angie-module-lua: depends on angie-module-ndk
 		## angie-module-set-misc: depends on angie-module-ndk
+
+		# unset want_ndk
+		# want_ndk=0
+		# if list_have_item "${NGX_HTTP_MODULES}" lua ; then
+		# 	want_ndk=1
+		# elif list_have_item "${NGX_HTTP_MODULES}" set-misc ; then
+		# 	want_ndk=1
+		# fi
+		# if [ ${want_ndk} = 1 ] ; then
+		# 	NGX_HTTP_MODULES=$(prepend_list "${NGX_HTTP_MODULES}" ndk)
+		# fi
+		# unset want_ndk
 		NGX_HTTP_MODULES=$(
 			printf '%s' "${NGX_HTTP_MODULES}" \
 			| sed -zE 's/(\s|^)(lua|set-misc)(\s|$)/\1ndk \2\3/g'
@@ -28,19 +42,17 @@ if [ "${NGX_HTTP}" = 1 ] ; then
 
 		if is_builtin_module http "$i" ; then
 			log "$i is builtin module, moving to NGX_HTTP_CONFLOAD"
-			http_confload="${http_confload} $i"
+			http_confload=$(append_list "${http_confload}" "$i")
 			continue
 		fi
 
 		## naive deduplication
-		case " ${http_modules} " in
-		*" $i "* )
+		if list_have_item "${http_modules}" "$i" ; then
 			log "$i is already specified"
 			continue
-		;;
-		esac
+		fi
 
-		http_modules="${http_modules}${http_modules:+ }$i"
+		http_modules=$(append_list "${http_modules}" "$i")
 	done
 	unset i
 
@@ -55,14 +67,14 @@ if [ "${NGX_HTTP}" = 1 ] ; then
 	unset NGX_HTTP_WITH_MODSECURITY
 	NGX_HTTP_WITH_MODSECURITY=0
 	while : ; do
-		case " ${NGX_HTTP_MODULES} " in
-		*" modsecurity "* ) ;;
-		* ) break ;;
-		esac
+		if ! list_have_item "${NGX_HTTP_MODULES}" modsecurity ; then
+			break
+		fi
 
 		for d in /angie/modules /etc/angie/modules /etc/angie/modules.dist ; do
 			[ -d "$d" ] || continue
-			if [ -f "$d/ngx_http_modsecurity_module.so" ] ; then
+			[ -f "$d/ngx_http_modsecurity_module.so" ] || continue
+			if ! [ -h "$d/ngx_http_modsecurity_module.so" ] ; then
 				NGX_HTTP_WITH_MODSECURITY=1
 				break
 			fi
diff --git a/image-entry.d/31-mail-modules.envsh b/image-entry.d/31-mail-modules.envsh
index 83e4ab8..483258e 100755
--- a/image-entry.d/31-mail-modules.envsh
+++ b/image-entry.d/31-mail-modules.envsh
@@ -19,19 +19,17 @@ if [ "${NGX_MAIL}" = 1 ] ; then
 
 		if is_builtin_module mail "$i" ; then
 			log "$i is builtin module, moving to NGX_MAIL_CONFLOAD"
-			mail_confload="${mail_confload} $i"
+			mail_confload=$(append_list "${mail_confload}" "$i")
 			continue
 		fi
 
 		## naive deduplication
-		case " ${mail_modules} " in
-		*" $i "* )
+		if list_have_item "${mail_modules}" "$i" ; then
 			log "$i is already specified"
 			continue
-		;;
-		esac
+		fi
 
-		mail_modules="${mail_modules}${mail_modules:+ }$i"
+		mail_modules=$(append_list "${mail_modules}" "$i")
 	done
 	unset i
 
diff --git a/image-entry.d/41-stream-modules.envsh b/image-entry.d/41-stream-modules.envsh
index 473b817..0e5bdc9 100755
--- a/image-entry.d/41-stream-modules.envsh
+++ b/image-entry.d/41-stream-modules.envsh
@@ -19,19 +19,17 @@ if [ "${NGX_STREAM}" = 1 ] ; then
 
 		if is_builtin_module stream "$i" ; then
 			log "$i is builtin module, moving to NGX_STREAM_CONFLOAD"
-			stream_confload="${stream_confload} $i"
+			stream_confload=$(append_list "${stream_confload}" "$i")
 			continue
 		fi
 
 		## naive deduplication
-		case " ${stream_modules} " in
-		*" $i "* )
+		if list_have_item "${stream_modules}" "$i" ; then
 			log "$i is already specified"
 			continue
-		;;
-		esac
+		fi
 
-		stream_modules="${stream_modules}${stream_modules:+ }$i"
+		stream_modules=$(append_list "${stream_modules}" "$i")
 	done
 	unset i
 
diff --git a/image-entry.d/72-merge-tree.sh b/image-entry.d/72-merge-tree.sh
index 12a2085..e20f6a9 100755
--- a/image-entry.d/72-merge-tree.sh
+++ b/image-entry.d/72-merge-tree.sh
@@ -5,6 +5,22 @@ set -ef
 
 [ -d "${merged_root}" ] || install -d "${merged_root}"
 
+remap_path_int() {
+	printf '%s' "$2/${1#*/}"
+}
+
+remap_path() {
+	case "$1" in
+	/etc/angie/* ) remap_path_int "${1#/etc/angie/}" "$2" ;;
+	/angie/* )     remap_path_int "${1#/angie/}" "$2" ;;
+	## misbehavior!
+	* )
+		log_always "remap_path() doesn't know how to handle this path: '$1'"
+		return 1
+	;;
+	esac
+}
+
 for n in ${NGX_DIRS_MERGE} ; do
 	[ -n "$n" ] || continue
 
diff --git a/image-entry.d/73-expand-templates.sh b/image-entry.d/73-expand-templates.sh
index 2056a0a..f6688f7 100755
--- a/image-entry.d/73-expand-templates.sh
+++ b/image-entry.d/73-expand-templates.sh
@@ -13,6 +13,7 @@ cd "${merged_root}/"
 expand_error_delim() {
 	IEP_DEBUG=0 log_always ' ----------------------------------- '
 }
+unset expand_error_seen
 expand_error() {
 	[ "${expand_error_seen:-}" != 1 ] || return
 	expand_error_seen=1
diff --git a/image-entry.d/74-combine-tree.sh b/image-entry.d/74-combine-tree.sh
index a328fc3..9f25126 100755
--- a/image-entry.d/74-combine-tree.sh
+++ b/image-entry.d/74-combine-tree.sh
@@ -8,6 +8,7 @@ set -f
 load_error_delim() {
 	IEP_DEBUG=0 log_always ' ----------------------------------- '
 }
+unset load_error_seen
 load_error() {
 	[ "${load_error_seen:-}" != 1 ] || return
 	load_error_seen=1
@@ -47,7 +48,7 @@ for p in ${dirs} ; do
 	[ -d "$d/$p" ] || install_userdir "$d/$p" || load_error
 done
 
-if [ "${NGX_HTTP_WITH_MODSECURITY}" = 1 ] ; then
+if [ "${NGX_HTTP_WITH_MODSECURITY:-}" = 1 ] ; then
 	d="${target_root}/log"
 	for p in modsecurity modsecurity/concurrent ; do
 		[ -d "$d/$p" ] || install_userdir "$d/$p" || load_error
@@ -61,10 +62,23 @@ d="${target_root}/log"
 
 ## NB: if any error occurs above then configuration is merely empty and/or broken
 
+remap_path() {
+	[ -n "$1" ] || return
+
+	case "$1" in
+	"${merged_root}"/* ) echo "${target_root}${1#"${merged_root}"}" ;;
+	## misbehavior!
+	* )
+		log_always "remap_path() doesn't know how to handle this path: $1"
+		return 1
+	;;
+	esac
+}
+
 while read -r old_path ; do
 	[ -n "${old_path}" ] || continue
 
-	new_path=$(combine_remap_path "${old_path}")
+	new_path=$(remap_path "${old_path}")
 	[ -n "${new_path}" ]
 
 	new_dir="${new_path%/*}"