Since !146 (merged) (merged on 2021-09-07) we let the NixOS Let's Encrypt integration with NGINX handle TLS. That integration cares for interim self-signed certs until real ones are aquired. The section about creating TLS certs by hand so the service will start is obsolote.