diff --git a/README.md b/README.md
index 3a306ad..be0b10a 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,50 @@ tooling/build-stack.sh --up core         # base only (debugging)
 `--up` prints the DNS records to add for that mode. Down:
 `docker compose -f docker-compose.yml -f docker-compose.static.yml -f docker-compose.mirror.yml down`
 
+## Public TLS (host nginx in front of caddy)
+
+The LAN path above runs caddy on `:80`. To expose the stack publicly with real
+certs, the machine's own nginx terminates TLS and reverse-proxies every vhost to
+caddy by Host header. Caddy stays the single router (apex landing, `auth.`
+→ drasl, `pack.` packwiz, `distribution.` static).
+
+1. **Issue certs** (OVH DNS-01, no inbound ports needed):
+   ```sh
+   # .env: BASE_DOMAIN, LE_EMAIL, OVH_* creds, LE_SUBDOMAINS="auth pack distribution"
+   tooling/issue-letsencrypt.sh        # → certs/<name>/{cert,key}.pem
+   ```
+
+2. **Bind caddy to a localhost-only port** so only nginx reaches it (`.env`):
+   ```sh
+   CADDY_HTTP_PORT=8880
+   CADDY_HTTP_BIND=127.0.0.1
+   ```
+
+3. **Bring up the caddy ingress** (+ static, + distribution if used):
+   ```sh
+   docker compose -f docker-compose.yml -f docker-compose.caddy.yml \
+     -f docker-compose.static.yml -f docker-compose.distribution.yml up -d
+   ```
+
+4. **Render + install the nginx vhost** from `nginx/ulicraft-caddy.conf.tmpl`.
+   Substitute `CADDY_HTTP_PORT` (proxy target), `BASE_DOMAIN`, `APP_DIR` (repo
+   path on the host, for the cert files):
+   ```sh
+   CADDY_HTTP_PORT=8880 BASE_DOMAIN=ulicraft.net APP_DIR=/home/ubuntu/mc/ulicraft-server-v1 \
+     envsubst '$CADDY_HTTP_PORT $BASE_DOMAIN $APP_DIR' \
+     < nginx/ulicraft-caddy.conf.tmpl | sudo tee /etc/nginx/sites-available/ulicraft.conf
+   sudo ln -sf /etc/nginx/sites-available/ulicraft.conf /etc/nginx/sites-enabled/
+   sudo nginx -t && sudo systemctl reload nginx
+   ```
+
+Re-run step 4 whenever you add a subdomain (e.g. a new vhost) so its server
+block is rendered. `nginx/ulicraft.conf.tmpl` is the older alternative (nginx
+serves the static files itself + proxies only drasl) — pick one, not both.
+
+`distribution.${BASE_DOMAIN}` serves a static site whose web root lives in
+another repo: set `DISTRIBUTION_WEB_ROOT` (absolute host path) in `.env`; it's
+bind-mounted read-only via `docker-compose.distribution.yml`.
+
 ## Join (guests)
 
 1. Open `http://ulicraft.lan`, download FjordLauncherUnlocked for your OS.