diff --git a/nginx.tmpl b/nginx.tmpl
index 783c6434e..acaecff0c 100644
--- a/nginx.tmpl
+++ b/nginx.tmpl
@@ -450,33 +450,84 @@ proxy_set_header X-Original-URI $request_uri;
 proxy_set_header Proxy "";
 {{- end }}
 
-{{- /*
-     * Precompute some information about each vhost.  This is done early because
-     * the creation of fallback servers depends on DEFAULT_HOST, HTTPS_METHOD,
-     * and whether there are any missing certs.
-     */}}
-{{- range $vhost, $containers := groupByMulti $globals.containers "Env.VIRTUAL_HOST" "," }}
-    {{- $vhost := trim $vhost }}
-    {{- if not $vhost }}
+{{- /* Precompute some information about each vhost. */}}
+{{- range $hostname, $containers := groupByMulti $globals.containers "Env.VIRTUAL_HOST" "," }}
+    {{- $hostname = trim $hostname }}
+    {{- if not $hostname }}
         {{- /* Ignore containers with VIRTUAL_HOST set to the empty string. */}}
         {{- continue }}
     {{- end }}
+
     {{- $certName := first (groupByKeys $containers "Env.CERT_NAME") }}
-    {{- $vhostCert := closest (dir "/etc/nginx/certs") (printf "%s.crt" $vhost) }}
+    {{- $vhostCert := closest (dir "/etc/nginx/certs") (printf "%s.crt" $hostname) }}
     {{- $vhostCert = trimSuffix ".crt" $vhostCert }}
     {{- $vhostCert = trimSuffix ".key" $vhostCert }}
     {{- $cert := or $certName $vhostCert }}
     {{- $cert_ok := and (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert)) }}
-    {{- $default := eq $globals.Env.DEFAULT_HOST $vhost }}
+
+    {{- $default := eq $globals.Env.DEFAULT_HOST $hostname }}
     {{- $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) $globals.Env.HTTPS_METHOD "redirect" }}
-    {{- $http3 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http3.enable"))) $globals.Env.ENABLE_HTTP3 "false")}}
-    {{- $_ := set $globals.vhosts $vhost (dict
+    {{- $http2_enabled := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http2.enable"))) $globals.Env.ENABLE_HTTP2 "true")}}
+    {{- $http3_enabled := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http3.enable"))) $globals.Env.ENABLE_HTTP3 "false")}}
+
+    {{- $is_regexp := hasPrefix "~" $hostname }}
+    {{- $upstream_name := when (or $is_regexp $globals.sha1_upstream_name) (sha1 $hostname) $hostname }}
+
+    {{- /* Get the SERVER_TOKENS defined by containers w/ the same vhost, falling back to "". */}}
+    {{- $server_tokens := trim (or (first (groupByKeys $containers "Env.SERVER_TOKENS")) "") }}
+
+    {{- /* Get the SSL_POLICY defined by containers w/ the same vhost, falling back to empty string (use default). */}}
+    {{- $ssl_policy := or (first (groupByKeys $containers "Env.SSL_POLICY")) "" }}
+
+    {{- /* Get the HSTS defined by containers w/ the same vhost, falling back to "max-age=31536000". */}}
+    {{- $hsts := or (first (groupByKeys $containers "Env.HSTS")) (or $globals.Env.HSTS "max-age=31536000") }}
+
+    {{- /* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
+    {{- $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
+
+
+    {{- $tmp_paths := groupBy $containers "Env.VIRTUAL_PATH" }}
+    {{- $has_virtual_paths := gt (len $tmp_paths) 0}}
+    {{- if not $has_virtual_paths }}
+        {{- $tmp_paths = dict "/" $containers }}
+    {{- end }}
+
+    {{ $paths := dict }}
+
+    {{- range $path, $containers := $tmp_paths }}
+        {{- /* Get the VIRTUAL_PROTO defined by containers w/ the same vhost-vpath, falling back to "http". */}}
+        {{- $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}
+        {{- /* Get the NETWORK_ACCESS defined by containers w/ the same vhost, falling back to "external". */}}
+        {{- $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}
+
+        {{- $upstream := $upstream_name }}
+        {{- $dest := "" }}
+        {{- if $has_virtual_paths }}
+            {{- $sum := sha1 $path }}
+            {{- $upstream = printf "%s-%s" $upstream $sum }}
+            {{- $dest = (or (first (groupByKeys $containers "Env.VIRTUAL_DEST")) "") }}
+        {{- end }}
+        {{- $_ := set $paths $path (dict
+            "containers" $containers
+            "dest" $dest
+            "proto" $proto
+            "network_tag" $network_tag
+            "upstream" $upstream
+        ) }}
+    {{- end }}
+
+    {{- $_ := set $globals.vhosts $hostname (dict
         "cert" $cert
         "cert_ok" $cert_ok
-        "containers" $containers
         "default" $default
+        "hsts" $hsts
         "https_method" $https_method
-        "http3" $http3
+        "http2_enabled" $http2_enabled
+        "http3_enabled" $http3_enabled
+        "paths" $paths
+        "server_tokens" $server_tokens
+        "ssl_policy" $ssl_policy
+        "vhost_root" $vhost_root
     ) }}
 {{- end }}
 
@@ -499,7 +550,7 @@ proxy_set_header Proxy "";
     {{- $https_exists := false }}
     {{- $default_http_exists := false }}
     {{- $default_https_exists := false }}
-    {{- $http3 := false }}
+    {{- $http3_enabled := false }}
     {{- range $vhost := $globals.vhosts }}
         {{- $http := or (ne $vhost.https_method "nohttp") (not $vhost.cert_ok) }}
         {{- $https := ne $vhost.https_method "nohttps" }}
@@ -507,7 +558,7 @@ proxy_set_header Proxy "";
         {{- $https_exists = or $https_exists $https }}
         {{- $default_http_exists = or $default_http_exists (and $http $vhost.default) }}
         {{- $default_https_exists = or $default_https_exists (and $https $vhost.default) }}
-        {{- $http3 = or $http3 $vhost.http3 }}
+        {{- $http3_enabled = or $http3_enabled $vhost.http3_enabled }}
     {{- end }}
     {{- $fallback_http := and $http_exists (not $default_http_exists) }}
     {{- $fallback_https := and $https_exists (not $default_https_exists) }}
@@ -537,7 +588,7 @@ server {
             {{- if $globals.enable_ipv6 }}
     listen [::]:{{ $globals.external_https_port }} ssl; {{- /* Do not add `default_server` (see comment above). */}}
             {{- end }}
-            {{- if $http3 }}
+            {{- if $http3_enabled }}
     http3 on;
     listen {{ $globals.external_https_port }} quic reuseport; {{- /* Do not add `default_server` (see comment above). */}}
                 {{- if $globals.enable_ipv6 }}
@@ -567,60 +618,19 @@ server {
     {{- end }}
 {{- end }}
 
-{{- range $host, $vhost := $globals.vhosts }}
-    {{- $cert := $vhost.cert }}
-    {{- $cert_ok := $vhost.cert_ok }}
-    {{- $containers := $vhost.containers }}
+{{- range $hostname, $vhost := $globals.vhosts }}
     {{- $default_server := when $vhost.default "default_server" "" }}
-    {{- $https_method := $vhost.https_method }}
-    {{- $http2 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http2.enable"))) $globals.Env.ENABLE_HTTP2 "true")}}
-    {{- $http3 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http3.enable"))) $globals.Env.ENABLE_HTTP3 "false")}}
-
-    {{- $is_regexp := hasPrefix "~" $host }}
-    {{- $upstream_name := when (or $is_regexp $globals.sha1_upstream_name) (sha1 $host) $host }}
 
-    {{- $paths := groupBy $containers "Env.VIRTUAL_PATH" }}
-    {{- $nPaths := len $paths }}
-    {{- if eq $nPaths 0 }}
-        {{- $paths = dict "/" $containers }}
+    {{- range $path, $vpath := $vhost.paths }}
+# {{ $hostname }}{{ $path }}
+        {{ template "upstream" (dict "globals" $globals "Upstream" $vpath.upstream "Containers" $vpath.containers) }}
     {{- end }}
 
-    {{- range $path, $containers := $paths }}
-        {{- $upstream := $upstream_name }}
-        {{- if gt $nPaths 0 }}
-            {{- $sum := sha1 $path }}
-            {{- $upstream = printf "%s-%s" $upstream $sum }}
-        {{- end }}
-# {{ $host }}{{ $path }}
-{{ template "upstream" (dict "globals" $globals "Upstream" $upstream "Containers" $containers) }}
-    {{- end }}
-
-    {{- /*
-         * Get the SERVER_TOKENS defined by containers w/ the same vhost,
-         * falling back to "".
-         */}}
-    {{- $server_tokens := trim (or (first (groupByKeys $containers "Env.SERVER_TOKENS")) "") }}
-
-    {{- /*
-         * Get the SSL_POLICY defined by containers w/ the same vhost, falling
-         * back to empty string (use default).
-         */}}
-    {{- $ssl_policy := or (first (groupByKeys $containers "Env.SSL_POLICY")) "" }}
-
-    {{- /*
-         * Get the HSTS defined by containers w/ the same vhost, falling back to
-         * "max-age=31536000".
-         */}}
-    {{- $hsts := or (first (groupByKeys $containers "Env.HSTS")) (or $globals.Env.HSTS "max-age=31536000") }}
-
-    {{- /* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
-    {{- $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
-
-    {{- if and $cert_ok (eq $https_method "redirect") }}
+    {{- if and $vhost.cert_ok (eq $vhost.https_method "redirect") }}
 server {
-    server_name {{ $host }};
-        {{- if $server_tokens }}
-    server_tokens {{ $server_tokens }};
+    server_name {{ $hostname }};
+        {{- if $vhost.server_tokens }}
+    server_tokens {{ $vhost.server_tokens }};
         {{- end }}
     {{ $globals.access_log }}
     listen {{ $globals.external_http_port }} {{ $default_server }};
@@ -649,27 +659,27 @@ server {
     {{- end }}
 
 server {
-    server_name {{ $host }};
-    {{- if $server_tokens }}
-    server_tokens {{ $server_tokens }};
+    server_name {{ $hostname }};
+    {{- if $vhost.server_tokens }}
+    server_tokens {{ $vhost.server_tokens }};
     {{- end }}
     {{ $globals.access_log }}
-    {{- if $http2 }}
+    {{- if $vhost.http2_enabled }}
     http2 on;
     {{- end }}
-    {{- if or (eq $https_method "nohttps") (not $cert_ok) (eq $https_method "noredirect") }}
+    {{- if or (eq $vhost.https_method "nohttps") (not $vhost.cert_ok) (eq $vhost.https_method "noredirect") }}
     listen {{ $globals.external_http_port }} {{ $default_server }};
         {{- if $globals.enable_ipv6 }}
     listen [::]:{{ $globals.external_http_port }} {{ $default_server }};
         {{- end }}
     {{- end }}
-    {{- if ne $https_method "nohttps" }}
+    {{- if ne $vhost.https_method "nohttps" }}
     listen {{ $globals.external_https_port }} ssl {{ $default_server }};
         {{- if $globals.enable_ipv6 }}
     listen [::]:{{ $globals.external_https_port }} ssl {{ $default_server }};
         {{- end }}
 
-        {{- if $http3 }}
+        {{- if $vhost.http3_enabled }}
     http3 on;
     add_header alt-svc 'h3=":{{ $globals.external_https_port }}"; ma=86400;';
     listen {{ $globals.external_https_port }} quic {{ $default_server }};
@@ -678,30 +688,30 @@ server {
             {{- end }}
         {{- end }}
 
-        {{- if $cert_ok }}
-            {{- template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}
+        {{- if $vhost.cert_ok }}
+            {{- template "ssl_policy" (dict "ssl_policy" $vhost.ssl_policy) }}
 
     ssl_session_timeout 5m;
     ssl_session_cache shared:SSL:50m;
     ssl_session_tickets off;
 
-    ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
-    ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
+    ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $vhost.cert) }};
+    ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $vhost.cert) }};
 
-            {{- if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
-    ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
+            {{- if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $vhost.cert)) }}
+    ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $vhost.cert }};
             {{- end }}
 
-            {{- if (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert)) }}
+            {{- if (exists (printf "/etc/nginx/certs/%s.chain.pem" $vhost.cert)) }}
     ssl_stapling on;
     ssl_stapling_verify on;
-    ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $cert }};
+    ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $vhost.cert }};
             {{- end }}
 
-            {{- if (not (or (eq $https_method "noredirect") (eq $hsts "off"))) }}
+            {{- if (not (or (eq $vhost.https_method "noredirect") (eq $vhost.hsts "off"))) }}
     set $sts_header "";
     if ($https) {
-        set $sts_header "{{ trim $hsts }}";
+        set $sts_header "{{ trim $vhost.hsts }}";
     }
     add_header Strict-Transport-Security $sts_header always;
             {{- end }}
@@ -735,43 +745,26 @@ server {
         {{- end }}
     {{- end }}
 
-    {{- if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
-    include {{ printf "/etc/nginx/vhost.d/%s" $host }};
+    {{- if (exists (printf "/etc/nginx/vhost.d/%s" $hostname)) }}
+    include {{ printf "/etc/nginx/vhost.d/%s" $hostname }};
     {{- else if (exists "/etc/nginx/vhost.d/default") }}
     include /etc/nginx/vhost.d/default;
     {{- end }}
 
-    {{- range $path, $containers := $paths }}
-        {{- /*
-             * Get the VIRTUAL_PROTO defined by containers w/ the same
-             * vhost-vpath, falling back to "http".
-             */}}
-        {{- $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}
-
-        {{- /*
-             * Get the NETWORK_ACCESS defined by containers w/ the same vhost,
-             * falling back to "external".
-             */}}
-        {{- $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}
-        {{- $upstream := $upstream_name }}
-        {{- $dest := "" }}
-        {{- if gt $nPaths 0 }}
-            {{- $sum := sha1 $path }}
-            {{- $upstream = printf "%s-%s" $upstream $sum }}
-            {{- $dest = (or (first (groupByKeys $containers "Env.VIRTUAL_DEST")) "") }}
-        {{- end }}
+    {{- range $path, $vpath := $vhost.paths }}
         {{- template "location" (dict
             "Path" $path
-            "Proto" $proto
-            "Upstream" $upstream
-            "Host" $host
-            "VhostRoot" $vhost_root
-            "Dest" $dest
-            "NetworkTag" $network_tag
-            "Containers" $containers
+            "Proto" $vpath.proto
+            "Upstream" $vpath.upstream
+            "Host" $hostname
+            "VhostRoot" $vhost.vhost_root
+            "Dest" $vpath.dest
+            "NetworkTag" $vpath.network_tag
+            "Containers" $vpath.containers
         ) }}
     {{- end }}
-    {{- if and (not (contains $paths "/")) (ne $globals.default_root_response "none")}}
+
+    {{- if and (not (contains $vhost.paths "/")) (ne $globals.default_root_response "none")}}
     location / {
         return {{ $globals.default_root_response }};
     }