Expect to be using certbot by default
diff --git a/TODO.on.site b/TODO.on.site
index 61ac62b..e9ae803 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -3,9 +3,14 @@
* Set CANONICAL_WEB_URL in `gerrit/environment`
* Enable GitHub OAUTH in `gerrit/environment`
-To build:
-* nginx first because it creates selfsigned certificate `docker-compose build nginx`
-* then everything else `docker-compose build`
+Building using self-signed certificates:
+We always create a temporary, self-signed certificate which
+can be overwritten by certbot. If intending to test with the
+self-signed certificate, build nginx first:
+* `docker-compose build nginx`,
+then everything else:
+* `docker-compose build --build-arg SSL_VARIANT=selfsigned`
+which will register the self-signed certificate with Gerrit.
Get containers up:
* `docker-compose up`