update nginx

README.md

@@ -52,6 +52,29 @@ deployment to Let's Encrypt:
 ./manage.sh start
 ```
 
+## Nginx configuration
+
+At first `install.sh` or `manage.sh` run, the deployment copies its editable
+Nginx templates to `config/nginx/`. Those local files are never overwritten by
+an update:
+
+- `bootstrap.conf.template` serves the Let's Encrypt HTTP-01 challenge.
+- `http.conf.template` is used only in `SSL_MODE=none` test mode.
+- `tls.conf.template` is the active production HTTPS reverse-proxy template.
+- `sites/*.conf` is included by the HTTP and TLS templates for additional
+  virtual hosts.
+
+After editing a template or site snippet, recreate Nginx to render templates
+and apply the configuration:
+
+```sh
+./manage.sh reload-nginx
+```
+
+The command selects the active HTTP or TLS configuration and validates Nginx
+after recreating it. Keep certificates in `config/ssl` or `config/letsencrypt`;
+they remain read-only mounts separate from the editable Nginx configuration.
+
 ## Local checks
 
 ```sh