#https

Three environments sharing one fixed domain name, separated at the socket rather than by name, with a banner on every environment except production — and live proxy config rendered from a template, never linked into a repository where a branch switch could rewrite it.

Self-signed certificates cost work in every container, and no HTTPS hides bugs in cookies, redirects and OAuth2. I point the real domain at loopback and install the real certificate at the same path, so my laptop runs the same nginx config as production.