diff --git a/.env b/.env
new file mode 120000
index 0000000..b9ac8b9
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+environment
\ No newline at end of file
diff --git a/TODO.on.site b/TODO.on.site
index 89de46a..1ac2408 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -1,14 +1,11 @@
-To build:
-* nginx first because it creates selfsigned certificate:
-  docker-compose build --build-arg SELFSIGNED_REQ_HOST=hostname nginx
-  - optionally: --build-arg SELFSIGNED_REQ_ALT_NAMES="DNS:name1 ..."
-* docker-compose build --build-arg SELFSIGNED_REQ_HOST=hostname
-  - same build-args!
-
 Create environment files (cf. `git ls-files \*environment.template`):
 * Set SA_PUBLIC_DOMAIN_NAME in `environment`
 * Set CANONICAL_WEB_URL in `gerrit/environment`
 * Enable GitHub OAUTH in `gerrit/environment`
 
+To build:
+* nginx first because it creates selfsigned certificate `docker-compose build nginx`
+* then everything else `docker-compose build`
+
 Get containers up:
 * `docker-compose up`
diff --git a/docker-compose.yml b/docker-compose.yml
index 134196b..b700a60 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,6 +4,11 @@
     build:
       context: .
       dockerfile: nginx/Dockerfile
+      args:
+        - SELFSIGNED_REQ_HOST=${SA_PUBLIC_DOMAIN_NAME}
+        - SELFSIGNED_REQ_ALT_NAMES=DNS:${SA_PUBLIC_DOMAIN_NAME},
+            DNS:id.${SA_PUBLIC_DOMAIN_NAME}, DNS:mail.${SA_PUBLIC_DOMAIN_NAME},
+            DNS:review.${SA_PUBLIC_DOMAIN_NAME}
     env_file: environment
     ports:
       - "80:80"