diff --git a/puppet/zulip/templates/nginx/zulip-enterprise.template.erb b/puppet/zulip/templates/nginx/zulip-enterprise.template.erb
index 6cf3fdcd4d..91c098380f 100644
--- a/puppet/zulip/templates/nginx/zulip-enterprise.template.erb
+++ b/puppet/zulip/templates/nginx/zulip-enterprise.template.erb
@@ -1,28 +1,29 @@
+# For local IPC -- tusd to Django, or Django to Tornado
+server {
+<% if @nginx_http_only -%>
+    listen 127.0.0.1:<%= @nginx_listen_port %>;
+<% else -%>
+    listen 127.0.0.1:80;
+<% end -%>
+    location /api/internal/ {
+        include /etc/nginx/zulip-include/api_headers;
+        include uwsgi_params;
+    }
+    include /etc/nginx/zulip-include/localhost.d/*.conf;
+}
+
+
 <% if @nginx_http_only -%>
 <% else -%>
 server {
     listen 80;
     listen [::]:80;
 
-    location /api/internal/ {
-        # If coming from localhost, we do allow access to internal
-        # APIs over HTTP, without an HTTPS redirect.  Adding TLS does
-        # not add appreciable security to connections from localhost,
-        # and the certificate will never validate.
-        allow 127.0.0.1;
-        allow ::1;
-        deny all;
-
-        include /etc/nginx/zulip-include/api_headers;
-        include uwsgi_params;
-    }
-
     location / {
         return 301 https://$host$request_uri;
     }
 
     include /etc/nginx/zulip-include/certbot;
-    include /etc/nginx/zulip-include/localhost.d/*.conf;
 }
 <% end -%>