update

docs/deployment.md

@@ -57,6 +57,7 @@ config/
 │   ├── config/          # app.ini and Gitea configuration
 │   └── data/            # repositories, packages, and gitea.db
 ├── letsencrypt/         # account data, certificate, and private key
+├── ssl/                 # optional administrator-provided certificate
 ├── certbot-webroot/     # HTTP-01 challenge files
 └── backups/             # local offline snapshots
 ```
@@ -70,8 +71,24 @@ The contents are ignored by Git. They must never be committed.
 ```
 
 This prepares the runtime directories, creates the private Docker network,
-starts Gitea and the HTTP-only Nginx configuration, obtains one certificate
-covering both domains, and switches Nginx to TLS.
+starts Gitea and the HTTP-only Nginx configuration, obtains a certificate when
+using Let's Encrypt, and switches Nginx to TLS.
+
+For an administrator-provided certificate instead, place the certificate and
+key in `config/ssl/` and set:
+
+```dotenv
+SSL_MODE=custom
+SSL_CERTIFICATE_DIR=./config/ssl
+SSL_CERTIFICATE_FILE=fullchain.pem
+SSL_CERTIFICATE_KEY_FILE=privkey.pem
+```
+
+The certificate must cover both `BROKER_DOMAIN` and `GITEA_DOMAIN`. With custom
+mode, `bootstrap` skips Certbot and `renew` is intentionally unavailable;
+replace the files through the certificate provider's process and restart or
+reload Nginx. `SSL_CERTIFICATE_DIR` can point at another directory relative to
+the repository or at an absolute host path.
 
 Create the initial Gitea administrator:
 
@@ -122,7 +139,7 @@ the transition.
 
 ## 6. Renewal and backups
 
-Run renewal twice daily from root's crontab:
+When `SSL_MODE=letsencrypt`, run renewal twice daily from root's crontab:
 
 ```cron
 17 3,15 * * * cd /YOUR/INSTALL/PARENT/TA-Deployment-Access && ./manage.sh renew
@@ -142,10 +159,13 @@ datacenter loss. Also back up `.env` through a secrets-aware system.
 
 ```sh
 cd /YOUR/INSTALL/PARENT/TA-Deployment-Access
-git pull --ff-only
-docker compose --env-file .env -f deploy/gitea/compose.yaml pull
-./manage.sh start
+./update.sh
 ```
 
+The updater operates only on the current VM. It fast-forwards the checked-out
+branch, pulls the pinned Gitea image, rebuilds and restarts the local stack, and
+waits for the local broker to become healthy. It has no peer discovery, SSH, or
+multi-node update behavior.
+
 Pin image versions as supplied and review release notes before changing them.
 Never change Gitea between rootless and rootful image families in place.