updated readme.md

README.md

@@ -40,3 +40,18 @@ hugo  # builds to /public
 cp -r public ../fpov/roles/nginx-proxy/files/mysite/
 ```
 
+1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
+2. Nginx starts, runs certbot-entrypoint.sh:
+- Checks for /etc/letsencrypt/live/matrix.example.com
+- If missing → runs certbot certonly --standalone on port 8080
+- Writes certs to /etc/letsencrypt
+3. Nginx loads TLS certs, serves static site + proxies /_matrix/
+4. User visits https://matrix.example.com → gets your Hugo site.
+5. User visits https://matrix.example.com/_matrix/client → gets Synapse.
+6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
+
+Certificate renewal
+```
+# /etc/cron.d/certbot-renew
+0 3 * * * root podman exec nginx-matrix certbot renew --quiet
+```