# TLS Certificates

The docker-compose stack mounts this directory into `/etc/nginx/certs` inside the `nginx` container.  
By default, it contains a self-signed certificate (`tls.crt` / `tls.key`) generated for `localhost` so the HTTPS listener works out of the box.

For production use, replace `tls.crt` and `tls.key` with certificates issued by a trusted CA (keep the filenames the same or update the Nginx config accordingly).