Exercise 2: HTTPS via nginx and certbot — Possible Solution
====================================================================

CONFIGURING THE PROXY
------------------------------
Per this chapter, the nginx site config in
/etc/nginx/sites-available/nextjs-rebuild proxies all requests on port
80 to the PM2-managed Next.js process on http://localhost:3000. This
file needs to be symlinked into /etc/nginx/sites-enabled/ and nginx
reloaded (sudo nginx -t to check syntax, then sudo systemctl reload
nginx) before it actually takes effect.

RUNNING CERTBOT
------------------------------
sudo certbot --nginx -d nextjs-demo.example.com (using the site's own
real domain) edits that same nginx config file in place, adding the
real certificate file paths and a redirect from HTTP to HTTPS
automatically - certbot's own nginx plugin handles both the
certificate issuance and the config edit in one step.

CONFIRMING HTTPS WORKS
------------------------------
Visiting https://nextjs-demo.example.com (the real domain used) loads
the site correctly, with the browser showing a valid certificate (no
warning), and plain HTTP requests to the same domain redirect to HTTPS
automatically rather than serving content over the unencrypted
connection.

WHY THIS WORKS AS AN ANSWER
------------------------------
It includes the real activation steps (symlink + reload) that a plain
config file sitting in sites-available alone wouldn't actually apply,
and confirms the result by checking both that HTTPS itself works AND
that HTTP redirects rather than silently continuing to serve
unencrypted traffic.