This is based on the version in google docs.
It has some changes informed by our experience using the template so far.

Since !146 (merged on 2021-09-07) we let the NixOS Let's Encrypt integration
with NGINX handle TLS.  That integration cares for interim self-signed certs
until real ones are aquired.  The section about creating TLS certs by hand so
the service will start is obsolote.

Thanks @jcalderone for pointing me to it

`cp --recursive ...` is required for permission issues
`... --out-link result-docs` is required for path collision issues
the rest is at my discretion