TLS Certificates
The docker-compose stack mounts this directory into /etc/nginx/certs inside the nginx container.
By default, it contains a self-signed certificate (tls.crt / tls.key) generated for localhost so the HTTPS listener works out of the box.
For production use, replace tls.crt and tls.key with certificates issued by a trusted CA (keep the filenames the same or update the Nginx config accordingly).