Cert Fixes

src/tls.js

@@ -194,6 +194,18 @@ export function ensureCertificates({ force = false } = {}) {
     fs.writeFileSync(p.names, JSON.stringify(config.https.hostnames));
   }
 
+  // A very common mistake is editing .env and then using `docker compose restart`,
+  // which reuses the old environment. The symptom is a certificate covering only
+  // the defaults, so say so rather than letting it fail later in a browser.
+  const configured = config.https.hostnames;
+  if (configured.length === 1 && configured[0] === 'visitors.local') {
+    console.warn(
+      '[tls] HTTPS_HOSTNAMES is at its default. If you set it in .env, bring the container\n' +
+        '      back with "docker compose up -d" rather than "docker compose restart" — restart\n' +
+        '      keeps the environment the container started with.'
+    );
+  }
+
   return {
     key: fs.readFileSync(p.key),
     cert: fs.readFileSync(p.cert),