diff --git a/docs/networking/proxies/openresty.md b/docs/networking/proxies/openresty.md
index 867f514e2..ea8d0272b 100644
--- a/docs/networking/proxies/openresty.md
+++ b/docs/networking/proxies/openresty.md
@@ -284,41 +284,43 @@ dokku openresty:report node-js-app --openresty-computed-letsencrypt-email
 
 ### Settable properties
 
-Five properties (`image`, `log-level`, `letsencrypt-email`, `letsencrypt-server`, `allowed-letsencrypt-domains-func-base64`) are global only. The rest are app only - they cannot be set with `--global`.
+Five properties (`image`, `log-level`, `letsencrypt-email`, `letsencrypt-server`, `allowed-letsencrypt-domains-func-base64`) are global only. The rest may be set per-app or globally with `--global`; a global value applies to any app that has no per-app value, otherwise the built-in default is used.
 
-Global-only properties expose two report flags: `--openresty-global-<property>` returns the raw stored value (empty when the property has never been set), while `--openresty-computed-<property>` returns the effective value (the global value if set, otherwise the built-in default). The per-app `hsts` property additionally has a bare `--openresty-hsts` flag for the raw per-app value.
+Global-only properties expose two report flags: `--openresty-global-<property>` returns the raw stored value (empty when the property has never been set), while `--openresty-computed-<property>` returns the effective value (the global value if set, otherwise the built-in default).
+
+App-or-global properties expose three report flags: `--openresty-<property>` returns the raw per-app value (empty when unset), `--openresty-global-<property>` returns the raw global value (empty when unset), and `--openresty-computed-<property>` returns the effective value, resolving the per-app value first, then the global value, then the built-in default.
 
 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
-| `access-log-format` | app only | none | `--openresty-access-log-format` | Custom nginx `log_format` directive used for the access log |
-| `access-log-path` | app only | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path` | Path inside the openresty container where access logs are written |
+| `access-log-format` | app or global | none | `--openresty-access-log-format`, `--openresty-global-access-log-format`, `--openresty-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
+| `access-log-path` | app or global | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path`, `--openresty-global-access-log-path`, `--openresty-computed-access-log-path` | Path inside the openresty container where access logs are written |
 | `allowed-letsencrypt-domains-func-base64` | global only | _allow-all stub_ | `--openresty-global-allowed-letsencrypt-domains-func-base64`, `--openresty-computed-allowed-letsencrypt-domains-func-base64` | Base64-encoded Lua function deciding which domains may request a letsencrypt certificate |
-| `bind-address-ipv4` | app only | none | `--openresty-bind-address-ipv4` | IPv4 address the openresty server block binds to |
-| `bind-address-ipv6` | app only | `::` | `--openresty-bind-address-ipv6` | IPv6 address the openresty server block binds to |
-| `client-body-timeout` | app only | `60s` | `--openresty-client-body-timeout` | Time allowed to read the request body from the client |
-| `client-header-timeout` | app only | `60s` | `--openresty-client-header-timeout` | Time allowed to read the request header from the client |
-| `client-max-body-size` | app only | `1m` | `--openresty-client-max-body-size` | Maximum allowed request body size |
-| `error-log-path` | app only | _`/var/log/nginx/{app}-error.log`_ | `--openresty-error-log-path` | Path inside the openresty container where error logs are written |
-| `hsts` | app only | `true` | `--openresty-hsts`, `--openresty-global-hsts`, `--openresty-computed-hsts` | When `true`, emits a `Strict-Transport-Security` header on HTTPS responses |
-| `hsts-include-subdomains` | app only | `true` | `--openresty-hsts-include-subdomains` | Adds the `includeSubDomains` directive to the HSTS header |
-| `hsts-max-age` | app only | `15724800` | `--openresty-hsts-max-age` | `max-age` value (seconds) in the HSTS header |
-| `hsts-preload` | app only | `false` | `--openresty-hsts-preload` | Adds the `preload` directive to the HSTS header |
+| `bind-address-ipv4` | app or global | none | `--openresty-bind-address-ipv4`, `--openresty-global-bind-address-ipv4`, `--openresty-computed-bind-address-ipv4` | IPv4 address the openresty server block binds to |
+| `bind-address-ipv6` | app or global | `::` | `--openresty-bind-address-ipv6`, `--openresty-global-bind-address-ipv6`, `--openresty-computed-bind-address-ipv6` | IPv6 address the openresty server block binds to |
+| `client-body-timeout` | app or global | `60s` | `--openresty-client-body-timeout`, `--openresty-global-client-body-timeout`, `--openresty-computed-client-body-timeout` | Time allowed to read the request body from the client |
+| `client-header-timeout` | app or global | `60s` | `--openresty-client-header-timeout`, `--openresty-global-client-header-timeout`, `--openresty-computed-client-header-timeout` | Time allowed to read the request header from the client |
+| `client-max-body-size` | app or global | `1m` | `--openresty-client-max-body-size`, `--openresty-global-client-max-body-size`, `--openresty-computed-client-max-body-size` | Maximum allowed request body size |
+| `error-log-path` | app or global | _`/var/log/nginx/{app}-error.log`_ | `--openresty-error-log-path`, `--openresty-global-error-log-path`, `--openresty-computed-error-log-path` | Path inside the openresty container where error logs are written |
+| `hsts` | app or global | `true` | `--openresty-hsts`, `--openresty-global-hsts`, `--openresty-computed-hsts` | When `true`, emits a `Strict-Transport-Security` header on HTTPS responses |
+| `hsts-include-subdomains` | app or global | `true` | `--openresty-hsts-include-subdomains`, `--openresty-global-hsts-include-subdomains`, `--openresty-computed-hsts-include-subdomains` | Adds the `includeSubDomains` directive to the HSTS header |
+| `hsts-max-age` | app or global | `15724800` | `--openresty-hsts-max-age`, `--openresty-global-hsts-max-age`, `--openresty-computed-hsts-max-age` | `max-age` value (seconds) in the HSTS header |
+| `hsts-preload` | app or global | `false` | `--openresty-hsts-preload`, `--openresty-global-hsts-preload`, `--openresty-computed-hsts-preload` | Adds the `preload` directive to the HSTS header |
 | `image` | global only | _parsed from `plugins/openresty-vhosts/Dockerfile`_ | `--openresty-global-image`, `--openresty-computed-image` | Docker image used to run the openresty container |
-| `keepalive-timeout` | app only | `75s` | `--openresty-keepalive-timeout` | Time an idle keep-alive connection stays open |
+| `keepalive-timeout` | app or global | `75s` | `--openresty-keepalive-timeout`, `--openresty-global-keepalive-timeout`, `--openresty-computed-keepalive-timeout` | Time an idle keep-alive connection stays open |
 | `letsencrypt-email` | global only | none | `--openresty-global-letsencrypt-email`, `--openresty-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--openresty-global-letsencrypt-server`, `--openresty-computed-letsencrypt-server` | ACME directory used when requesting certificates |
-| `lingering-timeout` | app only | `5s` | `--openresty-lingering-timeout` | Time openresty waits for more client data when closing a connection |
+| `lingering-timeout` | app or global | `5s` | `--openresty-lingering-timeout`, `--openresty-global-lingering-timeout`, `--openresty-computed-lingering-timeout` | Time openresty waits for more client data when closing a connection |
 | `log-level` | global only | `ERROR` | `--openresty-global-log-level`, `--openresty-computed-log-level` | Openresty log level |
-| `proxy-buffer-size` | app only | _system pagesize_ | `--openresty-proxy-buffer-size` | Buffer size for reading the first part of the upstream response |
-| `proxy-buffering` | app only | `on` | `--openresty-proxy-buffering` | Whether openresty buffers upstream responses (`on` or `off`) |
-| `proxy-buffers` | app only | _`8 {pagesize}`_ | `--openresty-proxy-buffers` | Number and size of buffers used for an upstream response |
-| `proxy-busy-buffers-size` | app only | _`2 * pagesize`_ | `--openresty-proxy-busy-buffers-size` | Maximum buffer size that can be busy sending a response to the client |
-| `proxy-connect-timeout` | app only | `60s` | `--openresty-proxy-connect-timeout` | Time to establish a connection to the upstream |
-| `proxy-read-timeout` | app only | `60s` | `--openresty-proxy-read-timeout` | Time to read a response from the upstream |
-| `proxy-send-timeout` | app only | `60s` | `--openresty-proxy-send-timeout` | Time to transmit a request to the upstream |
-| `send-timeout` | app only | `60s` | `--openresty-send-timeout` | Time between two successive write operations to the client |
-| `underscore-in-headers` | app only | `off` | `--openresty-underscore-in-headers` | Whether to allow underscores in client request header field names |
-| `x-forwarded-for-value` | app only | `$remote_addr` | `--openresty-x-forwarded-for-value` | Value used for the `X-Forwarded-For` header |
-| `x-forwarded-port-value` | app only | `$server_port` | `--openresty-x-forwarded-port-value` | Value used for the `X-Forwarded-Port` header |
-| `x-forwarded-proto-value` | app only | `$scheme` | `--openresty-x-forwarded-proto-value` | Value used for the `X-Forwarded-Proto` header |
-| `x-forwarded-ssl` | app only | none | `--openresty-x-forwarded-ssl` | Value used for the `X-Forwarded-Ssl` header (e.g. `on`/`off`) |
+| `proxy-buffer-size` | app or global | _system pagesize_ | `--openresty-proxy-buffer-size`, `--openresty-global-proxy-buffer-size`, `--openresty-computed-proxy-buffer-size` | Buffer size for reading the first part of the upstream response |
+| `proxy-buffering` | app or global | `on` | `--openresty-proxy-buffering`, `--openresty-global-proxy-buffering`, `--openresty-computed-proxy-buffering` | Whether openresty buffers upstream responses (`on` or `off`) |
+| `proxy-buffers` | app or global | _`8 {pagesize}`_ | `--openresty-proxy-buffers`, `--openresty-global-proxy-buffers`, `--openresty-computed-proxy-buffers` | Number and size of buffers used for an upstream response |
+| `proxy-busy-buffers-size` | app or global | _`2 * pagesize`_ | `--openresty-proxy-busy-buffers-size`, `--openresty-global-proxy-busy-buffers-size`, `--openresty-computed-proxy-busy-buffers-size` | Maximum buffer size that can be busy sending a response to the client |
+| `proxy-connect-timeout` | app or global | `60s` | `--openresty-proxy-connect-timeout`, `--openresty-global-proxy-connect-timeout`, `--openresty-computed-proxy-connect-timeout` | Time to establish a connection to the upstream |
+| `proxy-read-timeout` | app or global | `60s` | `--openresty-proxy-read-timeout`, `--openresty-global-proxy-read-timeout`, `--openresty-computed-proxy-read-timeout` | Time to read a response from the upstream |
+| `proxy-send-timeout` | app or global | `60s` | `--openresty-proxy-send-timeout`, `--openresty-global-proxy-send-timeout`, `--openresty-computed-proxy-send-timeout` | Time to transmit a request to the upstream |
+| `send-timeout` | app or global | `60s` | `--openresty-send-timeout`, `--openresty-global-send-timeout`, `--openresty-computed-send-timeout` | Time between two successive write operations to the client |
+| `underscore-in-headers` | app or global | `off` | `--openresty-underscore-in-headers`, `--openresty-global-underscore-in-headers`, `--openresty-computed-underscore-in-headers` | Whether to allow underscores in client request header field names |
+| `x-forwarded-for-value` | app or global | `$remote_addr` | `--openresty-x-forwarded-for-value`, `--openresty-global-x-forwarded-for-value`, `--openresty-computed-x-forwarded-for-value` | Value used for the `X-Forwarded-For` header |
+| `x-forwarded-port-value` | app or global | `$server_port` | `--openresty-x-forwarded-port-value`, `--openresty-global-x-forwarded-port-value`, `--openresty-computed-x-forwarded-port-value` | Value used for the `X-Forwarded-Port` header |
+| `x-forwarded-proto-value` | app or global | `$scheme` | `--openresty-x-forwarded-proto-value`, `--openresty-global-x-forwarded-proto-value`, `--openresty-computed-x-forwarded-proto-value` | Value used for the `X-Forwarded-Proto` header |
+| `x-forwarded-ssl` | app or global | none | `--openresty-x-forwarded-ssl`, `--openresty-global-x-forwarded-ssl`, `--openresty-computed-x-forwarded-ssl` | Value used for the `X-Forwarded-Ssl` header (e.g. `on`/`off`) |
diff --git a/plugins/openresty-vhosts/command-functions b/plugins/openresty-vhosts/command-functions
index dfe090fc2..b4ec905f7 100755
--- a/plugins/openresty-vhosts/command-functions
+++ b/plugins/openresty-vhosts/command-functions
@@ -70,61 +70,165 @@ cmd-openresty-report-single() {
   local flag_map=()
   if [[ "$APP" == "--global" ]]; then
     flag_map=(
+      "--openresty-global-access-log-format: $(fn-openresty-global-access-log-format)"
+      "--openresty-computed-access-log-format: $(fn-openresty-computed-access-log-format "$APP")"
+      "--openresty-global-access-log-path: $(fn-openresty-global-access-log-path)"
+      "--openresty-computed-access-log-path: $(fn-openresty-computed-access-log-path "$APP")"
       "--openresty-global-allowed-letsencrypt-domains-func-base64: $(fn-openresty-global-allowed-letsencrypt-domains-func-base64)"
       "--openresty-computed-allowed-letsencrypt-domains-func-base64: $(fn-openresty-computed-allowed-letsencrypt-domains-func-base64)"
+      "--openresty-global-bind-address-ipv4: $(fn-openresty-global-bind-address-ipv4)"
+      "--openresty-computed-bind-address-ipv4: $(fn-openresty-computed-bind-address-ipv4 "$APP")"
+      "--openresty-global-bind-address-ipv6: $(fn-openresty-global-bind-address-ipv6)"
+      "--openresty-computed-bind-address-ipv6: $(fn-openresty-computed-bind-address-ipv6 "$APP")"
+      "--openresty-global-client-body-timeout: $(fn-openresty-global-client-body-timeout)"
+      "--openresty-computed-client-body-timeout: $(fn-openresty-computed-client-body-timeout "$APP")"
+      "--openresty-global-client-header-timeout: $(fn-openresty-global-client-header-timeout)"
+      "--openresty-computed-client-header-timeout: $(fn-openresty-computed-client-header-timeout "$APP")"
+      "--openresty-global-client-max-body-size: $(fn-openresty-global-client-max-body-size)"
+      "--openresty-computed-client-max-body-size: $(fn-openresty-computed-client-max-body-size "$APP")"
+      "--openresty-global-error-log-path: $(fn-openresty-global-error-log-path)"
+      "--openresty-computed-error-log-path: $(fn-openresty-computed-error-log-path "$APP")"
       "--openresty-global-hsts: $(fn-plugin-property-get-default "openresty" "--global" "hsts" "")"
       "--openresty-computed-hsts: $(fn-openresty-hsts-is-enabled "--global")"
+      "--openresty-global-hsts-include-subdomains: $(fn-openresty-global-hsts-include-subdomains)"
+      "--openresty-computed-hsts-include-subdomains: $(fn-openresty-computed-hsts-include-subdomains "$APP")"
+      "--openresty-global-hsts-max-age: $(fn-openresty-global-hsts-max-age)"
+      "--openresty-computed-hsts-max-age: $(fn-openresty-computed-hsts-max-age "$APP")"
+      "--openresty-global-hsts-preload: $(fn-openresty-global-hsts-preload)"
+      "--openresty-computed-hsts-preload: $(fn-openresty-computed-hsts-preload "$APP")"
       "--openresty-global-image: $(fn-openresty-global-image)"
       "--openresty-computed-image: $(fn-openresty-computed-image)"
+      "--openresty-global-keepalive-timeout: $(fn-openresty-global-keepalive-timeout)"
+      "--openresty-computed-keepalive-timeout: $(fn-openresty-computed-keepalive-timeout "$APP")"
       "--openresty-global-letsencrypt-email: $(fn-openresty-global-letsencrypt-email)"
       "--openresty-computed-letsencrypt-email: $(fn-openresty-computed-letsencrypt-email)"
       "--openresty-global-letsencrypt-server: $(fn-openresty-global-letsencrypt-server)"
       "--openresty-computed-letsencrypt-server: $(fn-openresty-computed-letsencrypt-server)"
+      "--openresty-global-lingering-timeout: $(fn-openresty-global-lingering-timeout)"
+      "--openresty-computed-lingering-timeout: $(fn-openresty-computed-lingering-timeout "$APP")"
       "--openresty-global-log-level: $(fn-openresty-global-log-level)"
       "--openresty-computed-log-level: $(fn-openresty-computed-log-level)"
+      "--openresty-global-proxy-buffer-size: $(fn-openresty-global-proxy-buffer-size)"
+      "--openresty-computed-proxy-buffer-size: $(fn-openresty-computed-proxy-buffer-size "$APP")"
+      "--openresty-global-proxy-buffering: $(fn-openresty-global-proxy-buffering)"
+      "--openresty-computed-proxy-buffering: $(fn-openresty-computed-proxy-buffering "$APP")"
+      "--openresty-global-proxy-buffers: $(fn-openresty-global-proxy-buffers)"
+      "--openresty-computed-proxy-buffers: $(fn-openresty-computed-proxy-buffers "$APP")"
+      "--openresty-global-proxy-busy-buffers-size: $(fn-openresty-global-proxy-busy-buffers-size)"
+      "--openresty-computed-proxy-busy-buffers-size: $(fn-openresty-computed-proxy-busy-buffers-size "$APP")"
+      "--openresty-global-proxy-connect-timeout: $(fn-openresty-global-proxy-connect-timeout)"
+      "--openresty-computed-proxy-connect-timeout: $(fn-openresty-computed-proxy-connect-timeout "$APP")"
+      "--openresty-global-proxy-read-timeout: $(fn-openresty-global-proxy-read-timeout)"
+      "--openresty-computed-proxy-read-timeout: $(fn-openresty-computed-proxy-read-timeout "$APP")"
+      "--openresty-global-proxy-send-timeout: $(fn-openresty-global-proxy-send-timeout)"
+      "--openresty-computed-proxy-send-timeout: $(fn-openresty-computed-proxy-send-timeout "$APP")"
+      "--openresty-global-send-timeout: $(fn-openresty-global-send-timeout)"
+      "--openresty-computed-send-timeout: $(fn-openresty-computed-send-timeout "$APP")"
+      "--openresty-global-underscore-in-headers: $(fn-openresty-global-underscore-in-headers)"
+      "--openresty-computed-underscore-in-headers: $(fn-openresty-computed-underscore-in-headers "$APP")"
+      "--openresty-global-x-forwarded-for-value: $(fn-openresty-global-x-forwarded-for-value)"
+      "--openresty-computed-x-forwarded-for-value: $(fn-openresty-computed-x-forwarded-for-value "$APP")"
+      "--openresty-global-x-forwarded-port-value: $(fn-openresty-global-x-forwarded-port-value)"
+      "--openresty-computed-x-forwarded-port-value: $(fn-openresty-computed-x-forwarded-port-value "$APP")"
+      "--openresty-global-x-forwarded-proto-value: $(fn-openresty-global-x-forwarded-proto-value)"
+      "--openresty-computed-x-forwarded-proto-value: $(fn-openresty-computed-x-forwarded-proto-value "$APP")"
+      "--openresty-global-x-forwarded-ssl: $(fn-openresty-global-x-forwarded-ssl)"
+      "--openresty-computed-x-forwarded-ssl: $(fn-openresty-computed-x-forwarded-ssl "$APP")"
     )
   else
     verify_app_name "$APP"
     flag_map=(
       "--openresty-access-log-format: $(fn-openresty-access-log-format "$APP")"
+      "--openresty-computed-access-log-format: $(fn-openresty-computed-access-log-format "$APP")"
+      "--openresty-global-access-log-format: $(fn-openresty-global-access-log-format)"
       "--openresty-access-log-path: $(fn-openresty-access-log-path "$APP")"
+      "--openresty-computed-access-log-path: $(fn-openresty-computed-access-log-path "$APP")"
+      "--openresty-global-access-log-path: $(fn-openresty-global-access-log-path)"
       "--openresty-global-allowed-letsencrypt-domains-func-base64: $(fn-openresty-global-allowed-letsencrypt-domains-func-base64)"
       "--openresty-computed-allowed-letsencrypt-domains-func-base64: $(fn-openresty-computed-allowed-letsencrypt-domains-func-base64)"
       "--openresty-bind-address-ipv4: $(fn-openresty-bind-address-ipv4 "$APP")"
+      "--openresty-computed-bind-address-ipv4: $(fn-openresty-computed-bind-address-ipv4 "$APP")"
+      "--openresty-global-bind-address-ipv4: $(fn-openresty-global-bind-address-ipv4)"
       "--openresty-bind-address-ipv6: $(fn-openresty-bind-address-ipv6 "$APP")"
+      "--openresty-computed-bind-address-ipv6: $(fn-openresty-computed-bind-address-ipv6 "$APP")"
+      "--openresty-global-bind-address-ipv6: $(fn-openresty-global-bind-address-ipv6)"
       "--openresty-client-body-timeout: $(fn-openresty-client-body-timeout "$APP")"
+      "--openresty-computed-client-body-timeout: $(fn-openresty-computed-client-body-timeout "$APP")"
+      "--openresty-global-client-body-timeout: $(fn-openresty-global-client-body-timeout)"
       "--openresty-client-header-timeout: $(fn-openresty-client-header-timeout "$APP")"
+      "--openresty-computed-client-header-timeout: $(fn-openresty-computed-client-header-timeout "$APP")"
+      "--openresty-global-client-header-timeout: $(fn-openresty-global-client-header-timeout)"
       "--openresty-client-max-body-size: $(fn-openresty-client-max-body-size "$APP")"
+      "--openresty-computed-client-max-body-size: $(fn-openresty-computed-client-max-body-size "$APP")"
+      "--openresty-global-client-max-body-size: $(fn-openresty-global-client-max-body-size)"
       "--openresty-error-log-path: $(fn-openresty-error-log-path "$APP")"
-      "--openresty-global-hsts: $(fn-plugin-property-get-default "openresty" "--global" "hsts" "")"
-      "--openresty-computed-hsts: $(fn-openresty-hsts-is-enabled "$APP")"
+      "--openresty-computed-error-log-path: $(fn-openresty-computed-error-log-path "$APP")"
+      "--openresty-global-error-log-path: $(fn-openresty-global-error-log-path)"
       "--openresty-hsts: $(fn-plugin-property-get-default "openresty" "$APP" "hsts" "")"
+      "--openresty-computed-hsts: $(fn-openresty-hsts-is-enabled "$APP")"
+      "--openresty-global-hsts: $(fn-plugin-property-get-default "openresty" "--global" "hsts" "")"
       "--openresty-hsts-include-subdomains: $(fn-openresty-hsts-include-subdomains "$APP")"
+      "--openresty-computed-hsts-include-subdomains: $(fn-openresty-computed-hsts-include-subdomains "$APP")"
+      "--openresty-global-hsts-include-subdomains: $(fn-openresty-global-hsts-include-subdomains)"
       "--openresty-hsts-max-age: $(fn-openresty-hsts-max-age "$APP")"
+      "--openresty-computed-hsts-max-age: $(fn-openresty-computed-hsts-max-age "$APP")"
+      "--openresty-global-hsts-max-age: $(fn-openresty-global-hsts-max-age)"
       "--openresty-hsts-preload: $(fn-openresty-hsts-preload "$APP")"
+      "--openresty-computed-hsts-preload: $(fn-openresty-computed-hsts-preload "$APP")"
+      "--openresty-global-hsts-preload: $(fn-openresty-global-hsts-preload)"
       "--openresty-global-image: $(fn-openresty-global-image)"
       "--openresty-computed-image: $(fn-openresty-computed-image)"
       "--openresty-keepalive-timeout: $(fn-openresty-keepalive-timeout "$APP")"
+      "--openresty-computed-keepalive-timeout: $(fn-openresty-computed-keepalive-timeout "$APP")"
+      "--openresty-global-keepalive-timeout: $(fn-openresty-global-keepalive-timeout)"
       "--openresty-global-letsencrypt-email: $(fn-openresty-global-letsencrypt-email)"
       "--openresty-computed-letsencrypt-email: $(fn-openresty-computed-letsencrypt-email)"
       "--openresty-global-letsencrypt-server: $(fn-openresty-global-letsencrypt-server)"
       "--openresty-computed-letsencrypt-server: $(fn-openresty-computed-letsencrypt-server)"
+      "--openresty-lingering-timeout: $(fn-openresty-lingering-timeout "$APP")"
+      "--openresty-computed-lingering-timeout: $(fn-openresty-computed-lingering-timeout "$APP")"
+      "--openresty-global-lingering-timeout: $(fn-openresty-global-lingering-timeout)"
       "--openresty-global-log-level: $(fn-openresty-global-log-level)"
       "--openresty-computed-log-level: $(fn-openresty-computed-log-level)"
-      "--openresty-lingering-timeout: $(fn-openresty-lingering-timeout "$APP")"
       "--openresty-proxy-buffer-size: $(fn-openresty-proxy-buffer-size "$APP")"
+      "--openresty-computed-proxy-buffer-size: $(fn-openresty-computed-proxy-buffer-size "$APP")"
+      "--openresty-global-proxy-buffer-size: $(fn-openresty-global-proxy-buffer-size)"
       "--openresty-proxy-buffering: $(fn-openresty-proxy-buffering "$APP")"
+      "--openresty-computed-proxy-buffering: $(fn-openresty-computed-proxy-buffering "$APP")"
+      "--openresty-global-proxy-buffering: $(fn-openresty-global-proxy-buffering)"
       "--openresty-proxy-buffers: $(fn-openresty-proxy-buffers "$APP")"
+      "--openresty-computed-proxy-buffers: $(fn-openresty-computed-proxy-buffers "$APP")"
+      "--openresty-global-proxy-buffers: $(fn-openresty-global-proxy-buffers)"
       "--openresty-proxy-busy-buffers-size: $(fn-openresty-proxy-busy-buffers-size "$APP")"
+      "--openresty-computed-proxy-busy-buffers-size: $(fn-openresty-computed-proxy-busy-buffers-size "$APP")"
+      "--openresty-global-proxy-busy-buffers-size: $(fn-openresty-global-proxy-busy-buffers-size)"
       "--openresty-proxy-connect-timeout: $(fn-openresty-proxy-connect-timeout "$APP")"
+      "--openresty-computed-proxy-connect-timeout: $(fn-openresty-computed-proxy-connect-timeout "$APP")"
+      "--openresty-global-proxy-connect-timeout: $(fn-openresty-global-proxy-connect-timeout)"
       "--openresty-proxy-read-timeout: $(fn-openresty-proxy-read-timeout "$APP")"
+      "--openresty-computed-proxy-read-timeout: $(fn-openresty-computed-proxy-read-timeout "$APP")"
+      "--openresty-global-proxy-read-timeout: $(fn-openresty-global-proxy-read-timeout)"
       "--openresty-proxy-send-timeout: $(fn-openresty-proxy-send-timeout "$APP")"
+      "--openresty-computed-proxy-send-timeout: $(fn-openresty-computed-proxy-send-timeout "$APP")"
+      "--openresty-global-proxy-send-timeout: $(fn-openresty-global-proxy-send-timeout)"
       "--openresty-send-timeout: $(fn-openresty-send-timeout "$APP")"
+      "--openresty-computed-send-timeout: $(fn-openresty-computed-send-timeout "$APP")"
+      "--openresty-global-send-timeout: $(fn-openresty-global-send-timeout)"
       "--openresty-underscore-in-headers: $(fn-openresty-underscore-in-headers "$APP")"
+      "--openresty-computed-underscore-in-headers: $(fn-openresty-computed-underscore-in-headers "$APP")"
+      "--openresty-global-underscore-in-headers: $(fn-openresty-global-underscore-in-headers)"
       "--openresty-x-forwarded-for-value: $(fn-openresty-x-forwarded-for-value "$APP")"
+      "--openresty-computed-x-forwarded-for-value: $(fn-openresty-computed-x-forwarded-for-value "$APP")"
+      "--openresty-global-x-forwarded-for-value: $(fn-openresty-global-x-forwarded-for-value)"
       "--openresty-x-forwarded-port-value: $(fn-openresty-x-forwarded-port-value "$APP")"
+      "--openresty-computed-x-forwarded-port-value: $(fn-openresty-computed-x-forwarded-port-value "$APP")"
+      "--openresty-global-x-forwarded-port-value: $(fn-openresty-global-x-forwarded-port-value)"
       "--openresty-x-forwarded-proto-value: $(fn-openresty-x-forwarded-proto-value "$APP")"
+      "--openresty-computed-x-forwarded-proto-value: $(fn-openresty-computed-x-forwarded-proto-value "$APP")"
+      "--openresty-global-x-forwarded-proto-value: $(fn-openresty-global-x-forwarded-proto-value)"
       "--openresty-x-forwarded-ssl: $(fn-openresty-x-forwarded-ssl "$APP")"
+      "--openresty-computed-x-forwarded-ssl: $(fn-openresty-computed-x-forwarded-ssl "$APP")"
+      "--openresty-global-x-forwarded-ssl: $(fn-openresty-global-x-forwarded-ssl)"
     )
   fi
 
diff --git a/plugins/openresty-vhosts/docker-args-process-deploy b/plugins/openresty-vhosts/docker-args-process-deploy
index d75256800..e2d9278a2 100755
--- a/plugins/openresty-vhosts/docker-args-process-deploy
+++ b/plugins/openresty-vhosts/docker-args-process-deploy
@@ -141,27 +141,27 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
 
   output="$output '--label=openresty.letsencrypt=$letsencrypt_value'"
 
-  value="$(fn-openresty-access-log-format "$APP")"
+  value="$(fn-openresty-computed-access-log-format "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.access-log-format=$value'"
-  value="$(fn-openresty-access-log-path "$APP")"
+  value="$(fn-openresty-computed-access-log-path "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.access-log-path=$value'"
-  value="$(fn-openresty-bind-address-ipv4 "$APP")"
+  value="$(fn-openresty-computed-bind-address-ipv4 "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.bind-address-ipv4=$value'"
-  value="$(fn-openresty-bind-address-ipv6 "$APP")"
+  value="$(fn-openresty-computed-bind-address-ipv6 "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.bind-address-ipv6=$value'"
-  value="$(fn-openresty-client-body-timeout "$APP")"
+  value="$(fn-openresty-computed-client-body-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.client-body-timeout=$value'"
-  value="$(fn-openresty-client-header-timeout "$APP")"
+  value="$(fn-openresty-computed-client-header-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.client-header-timeout=$value'"
-  value="$(fn-openresty-client-max-body-size "$APP")"
+  value="$(fn-openresty-computed-client-max-body-size "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.client-max-body-size=$value'"
-  value="$(fn-openresty-error-log-path "$APP")"
+  value="$(fn-openresty-computed-error-log-path "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.error-log-path=$value'"
-  value="$(fn-openresty-hsts-include-subdomains "$APP")"
+  value="$(fn-openresty-computed-hsts-include-subdomains "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.hsts-include-subdomains=$value'"
-  value="$(fn-openresty-hsts-max-age "$APP")"
+  value="$(fn-openresty-computed-hsts-max-age "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.hsts-max-age=$value'"
-  value="$(fn-openresty-hsts-preload "$APP")"
+  value="$(fn-openresty-computed-hsts-preload "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.hsts-preload=$value'"
   value="$(fn-openresty-hsts-is-enabled "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.hsts=$value'"
@@ -171,39 +171,39 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
   [[ -n "$value" ]] && output="$output '--label=openresty.domains=$value'"
   value="$(plugn trigger network-get-property "$APP" initial-network)"
   [[ -n "$value" ]] && output="$output '--label=openresty.initial-network=$value'"
-  value="$(fn-openresty-keepalive-timeout "$APP")"
+  value="$(fn-openresty-computed-keepalive-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.keepalive-timeout=$value'"
-  value="$(fn-openresty-lingering-timeout "$APP")"
+  value="$(fn-openresty-computed-lingering-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.lingering-timeout=$value'"
   value="$(echo "$APP_PORT_MAP" | xargs)"
   [[ -n "$value" ]] && output="$output '--label=openresty.port-mapping=$value'"
-  value="$(fn-openresty-proxy-buffer-size "$APP")"
+  value="$(fn-openresty-computed-proxy-buffer-size "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-buffer-size=$value'"
-  value="$(fn-openresty-proxy-buffering "$APP")"
+  value="$(fn-openresty-computed-proxy-buffering "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-buffering=$value'"
-  value="$(fn-openresty-proxy-buffers "$APP")"
+  value="$(fn-openresty-computed-proxy-buffers "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-buffers=$value'"
-  value="$(fn-openresty-proxy-busy-buffers-size "$APP")"
+  value="$(fn-openresty-computed-proxy-busy-buffers-size "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-busy-buffer-size=$value'"
-  value="$(fn-openresty-proxy-connect-timeout "$APP")"
+  value="$(fn-openresty-computed-proxy-connect-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-connect-timeout=$value'"
-  value="$(fn-openresty-proxy-read-timeout "$APP")"
+  value="$(fn-openresty-computed-proxy-read-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-read-timeout=$value'"
-  value="$(fn-openresty-proxy-send-timeout "$APP")"
+  value="$(fn-openresty-computed-proxy-send-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.proxy-send-timeout=$value'"
-  value="$(fn-openresty-send-timeout "$APP")"
+  value="$(fn-openresty-computed-send-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.send-timeout=$value'"
-  value="$(fn-openresty-send-timeout "$APP")"
+  value="$(fn-openresty-computed-send-timeout "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.send-timeout=$value'"
-  value="$(fn-openresty-underscore-in-headers "$APP")"
+  value="$(fn-openresty-computed-underscore-in-headers "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.underscore-in-headers=$value'"
-  value="$(fn-openresty-x-forwarded-for-value "$APP")"
+  value="$(fn-openresty-computed-x-forwarded-for-value "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.x-forwarded-for-value=$value'"
-  value="$(fn-openresty-x-forwarded-port-value "$APP")"
+  value="$(fn-openresty-computed-x-forwarded-port-value "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.x-forwarded-port-value=$value'"
-  value="$(fn-openresty-x-forwarded-proto-value "$APP")"
+  value="$(fn-openresty-computed-x-forwarded-proto-value "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.x-forwarded-proto-value=$value'"
-  value="$(fn-openresty-x-forwarded-ssl "$APP")"
+  value="$(fn-openresty-computed-x-forwarded-ssl "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.x-forwarded-ssl=$value'"
 
   local proxy_labels_file_path=$(fn-proxy-get-labels-file-path "openresty" "$APP")
diff --git a/plugins/openresty-vhosts/internal-functions b/plugins/openresty-vhosts/internal-functions
index e3ab20099..cfd1490be 100755
--- a/plugins/openresty-vhosts/internal-functions
+++ b/plugins/openresty-vhosts/internal-functions
@@ -12,18 +12,52 @@ fn-get-pagesize() {
 }
 
 fn-openresty-access-log-format() {
-  declare desc="get the configured access log format"
+  declare desc="get the raw per-app access log format"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "access-log-format" ""
+  fn-plugin-property-get "openresty" "$APP" "access-log-format" ""
+}
+
+fn-openresty-global-access-log-format() {
+  declare desc="get the raw global access log format"
+
+  fn-plugin-property-get "openresty" "--global" "access-log-format" ""
+}
+
+fn-openresty-computed-access-log-format() {
+  declare desc="get the effective access log format"
+  declare APP="$1"
+  local value="$(fn-openresty-access-log-format "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "access-log-format" "")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-access-log-path() {
-  declare desc="get the configured access log path"
+  declare desc="get the raw per-app access log path"
+  declare APP="$1"
+
+  fn-plugin-property-get "openresty" "$APP" "access-log-path" ""
+}
+
+fn-openresty-global-access-log-path() {
+  declare desc="get the raw global access log path"
+
+  fn-plugin-property-get "openresty" "--global" "access-log-path" ""
+}
+
+fn-openresty-computed-access-log-path() {
+  declare desc="get the effective access log path"
   declare APP="$1"
   local OPENRESTY_LOG_ROOT="$(fn-openresty-log-root)"
+  local value="$(fn-openresty-access-log-path "$APP")"
 
-  fn-plugin-property-get-default "openresty" "$APP" "access-log-path" "${OPENRESTY_LOG_ROOT}/${APP}-access.log"
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "access-log-path" "${OPENRESTY_LOG_ROOT}/${APP}-access.log")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-global-allowed-letsencrypt-domains-func-base64() {
@@ -39,46 +73,148 @@ fn-openresty-computed-allowed-letsencrypt-domains-func-base64() {
 }
 
 fn-openresty-bind-address-ipv4() {
-  declare desc="get the configured ipv4 bind address"
+  declare desc="get the raw per-app ipv4 bind address"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "bind-address-ipv4" ""
+  fn-plugin-property-get "openresty" "$APP" "bind-address-ipv4" ""
+}
+
+fn-openresty-global-bind-address-ipv4() {
+  declare desc="get the raw global ipv4 bind address"
+
+  fn-plugin-property-get "openresty" "--global" "bind-address-ipv4" ""
+}
+
+fn-openresty-computed-bind-address-ipv4() {
+  declare desc="get the effective ipv4 bind address"
+  declare APP="$1"
+  local value="$(fn-openresty-bind-address-ipv4 "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "bind-address-ipv4" "")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-bind-address-ipv6() {
-  declare desc="get the configured ipv6 bind address"
+  declare desc="get the raw per-app ipv6 bind address"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "bind-address-ipv6" "::"
+  fn-plugin-property-get "openresty" "$APP" "bind-address-ipv6" ""
+}
+
+fn-openresty-global-bind-address-ipv6() {
+  declare desc="get the raw global ipv6 bind address"
+
+  fn-plugin-property-get "openresty" "--global" "bind-address-ipv6" ""
+}
+
+fn-openresty-computed-bind-address-ipv6() {
+  declare desc="get the effective ipv6 bind address"
+  declare APP="$1"
+  local value="$(fn-openresty-bind-address-ipv6 "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "bind-address-ipv6" "::")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-client-body-timeout() {
-  declare desc="get the configured client body timeout"
+  declare desc="get the raw per-app client body timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "client-body-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "client-body-timeout" ""
+}
+
+fn-openresty-global-client-body-timeout() {
+  declare desc="get the raw global client body timeout"
+
+  fn-plugin-property-get "openresty" "--global" "client-body-timeout" ""
+}
+
+fn-openresty-computed-client-body-timeout() {
+  declare desc="get the effective client body timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-client-body-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "client-body-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-client-header-timeout() {
-  declare desc="get the configured client header timeout"
+  declare desc="get the raw per-app client header timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "client-body-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "client-header-timeout" ""
+}
+
+fn-openresty-global-client-header-timeout() {
+  declare desc="get the raw global client header timeout"
+
+  fn-plugin-property-get "openresty" "--global" "client-header-timeout" ""
+}
+
+fn-openresty-computed-client-header-timeout() {
+  declare desc="get the effective client header timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-client-header-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "client-header-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-client-max-body-size() {
-  declare desc="get the configured client max body size"
+  declare desc="get the raw per-app client max body size"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "client-max-body-size" ""
+  fn-plugin-property-get "openresty" "$APP" "client-max-body-size" ""
+}
+
+fn-openresty-global-client-max-body-size() {
+  declare desc="get the raw global client max body size"
+
+  fn-plugin-property-get "openresty" "--global" "client-max-body-size" ""
+}
+
+fn-openresty-computed-client-max-body-size() {
+  declare desc="get the effective client max body size"
+  declare APP="$1"
+  local value="$(fn-openresty-client-max-body-size "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "client-max-body-size" "1m")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-error-log-path() {
-  declare desc="get the configured error log path"
+  declare desc="get the raw per-app error log path"
+  declare APP="$1"
+
+  fn-plugin-property-get "openresty" "$APP" "error-log-path" ""
+}
+
+fn-openresty-global-error-log-path() {
+  declare desc="get the raw global error log path"
+
+  fn-plugin-property-get "openresty" "--global" "error-log-path" ""
+}
+
+fn-openresty-computed-error-log-path() {
+  declare desc="get the effective error log path"
   declare APP="$1"
   local OPENRESTY_LOG_ROOT="$(fn-openresty-log-root)"
+  local value="$(fn-openresty-error-log-path "$APP")"
 
-  fn-plugin-property-get-default "openresty" "$APP" "error-log-path" "${OPENRESTY_LOG_ROOT}/${APP}-error.log"
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "error-log-path" "${OPENRESTY_LOG_ROOT}/${APP}-error.log")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-get-http-includes-dir() {
@@ -112,18 +248,75 @@ fn-openresty-get-location-includes-dir() {
 }
 
 fn-openresty-hsts-include-subdomains() {
+  declare desc="get the raw per-app hsts include subdomains value"
   declare APP="$1"
-  fn-plugin-property-get-default "openresty" "$APP" "hsts-include-subdomains" "true"
+
+  fn-plugin-property-get "openresty" "$APP" "hsts-include-subdomains" ""
+}
+
+fn-openresty-global-hsts-include-subdomains() {
+  declare desc="get the raw global hsts include subdomains value"
+
+  fn-plugin-property-get "openresty" "--global" "hsts-include-subdomains" ""
+}
+
+fn-openresty-computed-hsts-include-subdomains() {
+  declare desc="get the effective hsts include subdomains value"
+  declare APP="$1"
+  local value="$(fn-openresty-hsts-include-subdomains "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "hsts-include-subdomains" "true")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-hsts-max-age() {
+  declare desc="get the raw per-app hsts max age"
   declare APP="$1"
-  fn-plugin-property-get-default "openresty" "$APP" "hsts-max-age" "15724800"
+
+  fn-plugin-property-get "openresty" "$APP" "hsts-max-age" ""
+}
+
+fn-openresty-global-hsts-max-age() {
+  declare desc="get the raw global hsts max age"
+
+  fn-plugin-property-get "openresty" "--global" "hsts-max-age" ""
+}
+
+fn-openresty-computed-hsts-max-age() {
+  declare desc="get the effective hsts max age"
+  declare APP="$1"
+  local value="$(fn-openresty-hsts-max-age "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "hsts-max-age" "15724800")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-hsts-preload() {
+  declare desc="get the raw per-app hsts preload value"
   declare APP="$1"
-  fn-plugin-property-get-default "openresty" "$APP" "hsts-preload" "false"
+
+  fn-plugin-property-get "openresty" "$APP" "hsts-preload" ""
+}
+
+fn-openresty-global-hsts-preload() {
+  declare desc="get the raw global hsts preload value"
+
+  fn-plugin-property-get "openresty" "--global" "hsts-preload" ""
+}
+
+fn-openresty-computed-hsts-preload() {
+  declare desc="get the effective hsts preload value"
+  declare APP="$1"
+  local value="$(fn-openresty-hsts-preload "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "hsts-preload" "false")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-hsts-is-enabled() {
@@ -155,10 +348,27 @@ fn-openresty-computed-image() {
 }
 
 fn-openresty-keepalive-timeout() {
-  declare desc="get the configured keepalive timeout"
+  declare desc="get the raw per-app keepalive timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "keepalive-timeout" "75s"
+  fn-plugin-property-get "openresty" "$APP" "keepalive-timeout" ""
+}
+
+fn-openresty-global-keepalive-timeout() {
+  declare desc="get the raw global keepalive timeout"
+
+  fn-plugin-property-get "openresty" "--global" "keepalive-timeout" ""
+}
+
+fn-openresty-computed-keepalive-timeout() {
+  declare desc="get the effective keepalive timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-keepalive-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "keepalive-timeout" "75s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-global-letsencrypt-email() {
@@ -235,66 +445,219 @@ fn-openresty-logs-usage() {
 }
 
 fn-openresty-lingering-timeout() {
-  declare desc="get the configured lingering timeout"
+  declare desc="get the raw per-app lingering timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "lingering-timeout" "5s"
+  fn-plugin-property-get "openresty" "$APP" "lingering-timeout" ""
+}
+
+fn-openresty-global-lingering-timeout() {
+  declare desc="get the raw global lingering timeout"
+
+  fn-plugin-property-get "openresty" "--global" "lingering-timeout" ""
+}
+
+fn-openresty-computed-lingering-timeout() {
+  declare desc="get the effective lingering timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-lingering-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "lingering-timeout" "5s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-buffer-size() {
-  declare desc="get the configured proxy buffer size"
+  declare desc="get the raw per-app proxy buffer size"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-buffer-size" "$(fn-get-pagesize)k"
+  fn-plugin-property-get "openresty" "$APP" "proxy-buffer-size" ""
+}
+
+fn-openresty-global-proxy-buffer-size() {
+  declare desc="get the raw global proxy buffer size"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-buffer-size" ""
+}
+
+fn-openresty-computed-proxy-buffer-size() {
+  declare desc="get the effective proxy buffer size"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-buffer-size "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-buffer-size" "$(fn-get-pagesize)k")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-buffering() {
-  declare desc="get the configured proxy buffering"
+  declare desc="get the raw per-app proxy buffering"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-buffering" "on"
+  fn-plugin-property-get "openresty" "$APP" "proxy-buffering" ""
+}
+
+fn-openresty-global-proxy-buffering() {
+  declare desc="get the raw global proxy buffering"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-buffering" ""
+}
+
+fn-openresty-computed-proxy-buffering() {
+  declare desc="get the effective proxy buffering"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-buffering "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-buffering" "on")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-buffers() {
-  declare desc="get the configured proxy buffers"
+  declare desc="get the raw per-app proxy buffers"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-buffers" "8 $(fn-get-pagesize)k"
+  fn-plugin-property-get "openresty" "$APP" "proxy-buffers" ""
+}
+
+fn-openresty-global-proxy-buffers() {
+  declare desc="get the raw global proxy buffers"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-buffers" ""
+}
+
+fn-openresty-computed-proxy-buffers() {
+  declare desc="get the effective proxy buffers"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-buffers "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-buffers" "8 $(fn-get-pagesize)k")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-busy-buffers-size() {
-  declare desc="get the configured proxy busy buffers size"
+  declare desc="get the raw per-app proxy busy buffers size"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-busy-buffers-size" "$(($(fn-get-pagesize) * 2))k"
+  fn-plugin-property-get "openresty" "$APP" "proxy-busy-buffers-size" ""
+}
+
+fn-openresty-global-proxy-busy-buffers-size() {
+  declare desc="get the raw global proxy busy buffers size"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-busy-buffers-size" ""
+}
+
+fn-openresty-computed-proxy-busy-buffers-size() {
+  declare desc="get the effective proxy busy buffers size"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-busy-buffers-size "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-busy-buffers-size" "$(($(fn-get-pagesize) * 2))k")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-connect-timeout() {
-  declare desc="get the configured proxy connect timeout"
+  declare desc="get the raw per-app proxy connect timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-connect-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "proxy-connect-timeout" ""
+}
+
+fn-openresty-global-proxy-connect-timeout() {
+  declare desc="get the raw global proxy connect timeout"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-connect-timeout" ""
+}
+
+fn-openresty-computed-proxy-connect-timeout() {
+  declare desc="get the effective proxy connect timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-connect-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-connect-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-read-timeout() {
-  declare desc="get the configured proxy read timeout"
+  declare desc="get the raw per-app proxy read timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-read-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "proxy-read-timeout" ""
+}
+
+fn-openresty-global-proxy-read-timeout() {
+  declare desc="get the raw global proxy read timeout"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-read-timeout" ""
+}
+
+fn-openresty-computed-proxy-read-timeout() {
+  declare desc="get the effective proxy read timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-read-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-read-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-proxy-send-timeout() {
-  declare desc="get the configured proxy send timeout"
+  declare desc="get the raw per-app proxy send timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "proxy-send-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "proxy-send-timeout" ""
+}
+
+fn-openresty-global-proxy-send-timeout() {
+  declare desc="get the raw global proxy send timeout"
+
+  fn-plugin-property-get "openresty" "--global" "proxy-send-timeout" ""
+}
+
+fn-openresty-computed-proxy-send-timeout() {
+  declare desc="get the effective proxy send timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-proxy-send-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "proxy-send-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-send-timeout() {
-  declare desc="get the configured send timeout"
+  declare desc="get the raw per-app send timeout"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "send-timeout" "60s"
+  fn-plugin-property-get "openresty" "$APP" "send-timeout" ""
+}
+
+fn-openresty-global-send-timeout() {
+  declare desc="get the raw global send timeout"
+
+  fn-plugin-property-get "openresty" "--global" "send-timeout" ""
+}
+
+fn-openresty-computed-send-timeout() {
+  declare desc="get the effective send timeout"
+  declare APP="$1"
+  local value="$(fn-openresty-send-timeout "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "send-timeout" "60s")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-template-compose-file() {
@@ -321,36 +684,121 @@ fn-openresty-template-compose-file() {
 }
 
 fn-openresty-underscore-in-headers() {
-  declare desc="get the configured underscore in headers value"
+  declare desc="get the raw per-app underscore in headers value"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "underscore-in-headers" "off"
+  fn-plugin-property-get "openresty" "$APP" "underscore-in-headers" ""
+}
+
+fn-openresty-global-underscore-in-headers() {
+  declare desc="get the raw global underscore in headers value"
+
+  fn-plugin-property-get "openresty" "--global" "underscore-in-headers" ""
+}
+
+fn-openresty-computed-underscore-in-headers() {
+  declare desc="get the effective underscore in headers value"
+  declare APP="$1"
+  local value="$(fn-openresty-underscore-in-headers "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "underscore-in-headers" "off")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-x-forwarded-for-value() {
-  declare desc="get the configured x-forwarded-for value"
+  declare desc="get the raw per-app x-forwarded-for value"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "x-forwarded-for-value" "\$remote_addr"
+  fn-plugin-property-get "openresty" "$APP" "x-forwarded-for-value" ""
+}
+
+fn-openresty-global-x-forwarded-for-value() {
+  declare desc="get the raw global x-forwarded-for value"
+
+  fn-plugin-property-get "openresty" "--global" "x-forwarded-for-value" ""
+}
+
+fn-openresty-computed-x-forwarded-for-value() {
+  declare desc="get the effective x-forwarded-for value"
+  declare APP="$1"
+  local value="$(fn-openresty-x-forwarded-for-value "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "x-forwarded-for-value" "\$remote_addr")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-x-forwarded-port-value() {
-  declare desc="get the configured x-forwarded-port value"
+  declare desc="get the raw per-app x-forwarded-port value"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "x-forwarded-port-value" "\$server_port"
+  fn-plugin-property-get "openresty" "$APP" "x-forwarded-port-value" ""
+}
+
+fn-openresty-global-x-forwarded-port-value() {
+  declare desc="get the raw global x-forwarded-port value"
+
+  fn-plugin-property-get "openresty" "--global" "x-forwarded-port-value" ""
+}
+
+fn-openresty-computed-x-forwarded-port-value() {
+  declare desc="get the effective x-forwarded-port value"
+  declare APP="$1"
+  local value="$(fn-openresty-x-forwarded-port-value "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "x-forwarded-port-value" "\$server_port")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-x-forwarded-proto-value() {
-  declare desc="get the configured x-forwarded-proto value"
+  declare desc="get the raw per-app x-forwarded-proto value"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "x-forwarded-proto-value" "\$scheme"
+  fn-plugin-property-get "openresty" "$APP" "x-forwarded-proto-value" ""
+}
+
+fn-openresty-global-x-forwarded-proto-value() {
+  declare desc="get the raw global x-forwarded-proto value"
+
+  fn-plugin-property-get "openresty" "--global" "x-forwarded-proto-value" ""
+}
+
+fn-openresty-computed-x-forwarded-proto-value() {
+  declare desc="get the effective x-forwarded-proto value"
+  declare APP="$1"
+  local value="$(fn-openresty-x-forwarded-proto-value "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "x-forwarded-proto-value" "\$scheme")"
+  fi
+  echo "$value"
 }
 
 fn-openresty-x-forwarded-ssl() {
-  declare desc="get the configured x-forwarded-ssl value"
+  declare desc="get the raw per-app x-forwarded-ssl value"
   declare APP="$1"
 
-  fn-plugin-property-get-default "openresty" "$APP" "x-forwarded-ssl" ""
+  fn-plugin-property-get "openresty" "$APP" "x-forwarded-ssl" ""
+}
+
+fn-openresty-global-x-forwarded-ssl() {
+  declare desc="get the raw global x-forwarded-ssl value"
+
+  fn-plugin-property-get "openresty" "--global" "x-forwarded-ssl" ""
+}
+
+fn-openresty-computed-x-forwarded-ssl() {
+  declare desc="get the effective x-forwarded-ssl value"
+  declare APP="$1"
+  local value="$(fn-openresty-x-forwarded-ssl "$APP")"
+
+  if [[ -z "$value" ]]; then
+    value="$(fn-plugin-property-get "openresty" "--global" "x-forwarded-ssl" "")"
+  fi
+  echo "$value"
 }
diff --git a/plugins/openresty-vhosts/subcommands/set b/plugins/openresty-vhosts/subcommands/set
index 8a7620974..8fc21a322 100755
--- a/plugins/openresty-vhosts/subcommands/set
+++ b/plugins/openresty-vhosts/subcommands/set
@@ -10,7 +10,7 @@ cmd-openresty-set() {
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
   local VALID_KEYS=("access-log-format" "access-log-path" "allowed-letsencrypt-domains-func-base64" "bind-address-ipv4" "bind-address-ipv6" "client-body-timeout" "client-header-timeout" "client-max-body-size" "error-log-path" "hsts" "hsts-include-subdomains" "hsts-preload" "hsts-max-age" "image" "keepalive-timeout" "log-level" "letsencrypt-email" "letsencrypt-server" "lingering-timeout" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "proxy-connect-timeout" "proxy-read-timeout" "send-timeout" "proxy-send-timeout" "underscore-in-headers" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value" "x-forwarded-ssl")
-  local GLOBAL_KEYS=("allowed-letsencrypt-domains-func-base64" "image" "log-level" "letsencrypt-email" "letsencrypt-server")
+  local GLOBAL_KEYS=("${VALID_KEYS[@]}")
   local GLOBAL_ONLY_KEYS=("allowed-letsencrypt-domains-func-base64" "image" "log-level" "letsencrypt-email" "letsencrypt-server")
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
diff --git a/tests/unit/openresty.bats b/tests/unit/openresty.bats
index 5acf6feeb..6751438ff 100644
--- a/tests/unit/openresty.bats
+++ b/tests/unit/openresty.bats
@@ -13,6 +13,9 @@ setup() {
 
 teardown() {
   dokku openresty:set --global log-level >/dev/null 2>&1 || true
+  for key in bind-address-ipv6 keepalive-timeout client-body-timeout client-header-timeout client-max-body-size; do
+    dokku openresty:set --global "$key" >/dev/null || true
+  done
   global_teardown
   destroy_app
   dokku openresty:stop
@@ -212,6 +215,210 @@ teardown() {
   assert_output "ERROR"
 }
 
+@test "(openresty:report) per-app raw vs global vs computed for bind-address-ipv6" {
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-global-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "::"
+
+  run /bin/bash -c "dokku openresty:set $TEST_APP bind-address-ipv6 ::1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "::1"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "::1"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-global-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku openresty:set $TEST_APP bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-bind-address-ipv6"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "::"
+}
+
+@test "(openresty:report) per-app inherits global value, per-app overrides global" {
+  run /bin/bash -c "dokku openresty:set --global keepalive-timeout 90s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-global-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "90s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "90s"
+
+  run /bin/bash -c "dokku openresty:set $TEST_APP keepalive-timeout 30s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --format json | jq -r '.\"keepalive-timeout\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --format json | jq -r '.\"global-keepalive-timeout\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "90s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --format json | jq -r '.\"computed-keepalive-timeout\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:set $TEST_APP keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:set --global keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "75s"
+}
+
+@test "(openresty:report) client-header-timeout reads its own property key" {
+  run /bin/bash -c "dokku openresty:set $TEST_APP client-body-timeout 99s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-client-header-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "60s"
+
+  run /bin/bash -c "dokku openresty:set $TEST_APP client-header-timeout 30s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-client-header-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-client-header-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "30s"
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-client-body-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "99s"
+}
+
+@test "(openresty:report) client-max-body-size computed default is 1m" {
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-client-max-body-size"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku openresty:report $TEST_APP --openresty-computed-client-max-body-size"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1m"
+}
+
+@test "(openresty) per-app properties are settable globally" {
+  run /bin/bash -c "dokku openresty:set --global keepalive-timeout 90s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku openresty:report --global --openresty-global-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "90s"
+
+  run /bin/bash -c "dokku openresty:report --global --openresty-computed-keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "90s"
+
+  run /bin/bash -c "dokku openresty:set --global keepalive-timeout"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(openresty) global-only keys" {
   for key in allowed-letsencrypt-domains-func-base64 image log-level letsencrypt-email letsencrypt-server; do
     run /bin/bash -c "dokku openresty:set $TEST_APP $key somevalue"