diff --git a/README.md b/README.md
index 9a409987..755614e0 100644
--- a/README.md
+++ b/README.md
@@ -12,23 +12,23 @@ Includes emojis designed by [OpenMoji](https://openmoji.org) – the open-source
 
 [Customizations](README_customizations.md)
 
-## Install
+## Package Dependencies
 
 On Arch/Parabola:
 
 ``` bash
-sudo pacman -S tor python-pip python-pysocks python-pycryptodome python-beautifulsoup4 imagemagick python-pillow python-numpy python-dateutil
+sudo pacman -S tor python-pip python-pysocks python-pycryptodome python-beautifulsoup4 imagemagick python-pillow python-numpy python-dateutil certbot
 sudo pip install commentjson
 ```
 
 Or on Debian:
 
 ``` bash
-sudo apt-get -y install tor python3-pip python3-socks imagemagick python3-numpy python3-setuptools python3-crypto python3-dateutil python3-pil.imagetk
+sudo apt-get -y install tor python3-pip python3-socks imagemagick python3-numpy python3-setuptools python3-crypto python3-dateutil python3-pil.imagetk certbot
 sudo pip3 install commentjson beautifulsoup4 pycryptodome
 ```
 
-## Running the Server
+## Installation
 
 In the most common case you'll be using systemd to set up a daemon to run the server.
 
@@ -83,9 +83,98 @@ If it's not running then you can also look at the log:
 journalctl -u epicyon
 ```
 
-You'll also need to set up a web server configuration. An Nginx example is as follows:
+You'll also need to set up a web server configuration. For Nginx edit */etc/nginx/sites-available/YOUR_DOMAIN* as follows:
+
+``` nginx
+server {
+    listen 80;
+    listen [::]:80;
+    server_name YOUR_DOMAIN;
+    root /var/www/YOUR_DOMAIN/htdocs;
+    access_log /dev/null;
+    error_log /dev/null;
+    client_max_body_size 20m;
+    client_body_buffer_size 128k;
+
+    limit_conn conn_limit_per_ip 10;
+    limit_req zone=req_limit_per_ip burst=10 nodelay;
+
+    index index.html;
+    rewrite ^ https://$server_name$request_uri? permanent;
+}
+
+server {
+    listen 443 ssl;
+    server_name YOUR_DOMAIN;
+
+    ssl_stapling off;
+    ssl_stapling_verify off;
+    ssl on;
+    ssl_certificate /etc/letsencrypt/live/YOUR_DOMAIN/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN/privkey.pem;
+    #ssl_dhparam /etc/ssl/certs/YOUR_DOMAIN.dhparam;
+
+    ssl_session_cache  builtin:1000  shared:SSL:10m;
+    ssl_session_timeout 60m;
+    ssl_prefer_server_ciphers on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Download-Options noopen;
+    add_header X-Permitted-Cross-Domain-Policies none;
+
+    add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
+    add_header Strict-Transport-Security max-age=15768000;
+
+    access_log /dev/null;
+    error_log /dev/null;
+
+    root /var/www/YOUR_DOMAIN/htdocs;
+    index index.html;
+ 
+    location / {
+        proxy_http_version 1.1;
+        client_max_body_size 11M;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forward-Proto http;
+        proxy_set_header X-Nginx-Proxy true;
+        proxy_temp_file_write_size 64k;
+        proxy_connect_timeout 10080s;
+        proxy_send_timeout 10080;
+        proxy_read_timeout 10080;
+        proxy_buffer_size 64k;
+        proxy_buffers 16 32k;
+        proxy_busy_buffers_size 64k;
+        proxy_redirect off;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_pass http://localhost:7156;
+    }
+}
+```
+
+Changing your domain name as appropriate. Active the configuration with:
 
 ``` bash
+ln -s /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/
+```
+
+Generate a LetsEncrypt certificate.
+
+``` bash
+certbot certonly -n --server https://acme-v01.api.letsencrypt.org/directory --standalone -d YOUR_DOMAIN --renew-by-default --agree-tos --email YOUR_EMAIL
+```
+
+And restart the web server:
+
+``` bash
+systemctl restart nginx
 ```
 
 ## Object Capabilities Security