added opt-in managed nginx/TLS container (ADR 0005, plan step 13): server.nginx.* config serves GitTally over HTTPS on hosts without a reverse proxy — two-phase startup (ACME webroot via certbot container, then full HTTPS config), daily certificate renewal with nginx reload, labelled container removed on shutdown; all failures are non-fatal, the plain HTTP server keeps running

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/main/kotlin/de/hoennig/gittally/config/ConfigLoader.kt

@@ -21,11 +21,24 @@ class ConfigLoader {
 
     fun load(workingDir: Path = Paths.get(".")): GitTallyConfig {
         val raw = loadRaw(workingDir)
-        return if (raw.isEmpty()) {
-            GitTallyConfig()
-        } else {
-            yaml.convertValue(mergeBranchDefaults(raw), GitTallyConfig::class.java)
+        val config =
+            if (raw.isEmpty()) {
+                GitTallyConfig()
+            } else {
+                yaml.convertValue(mergeBranchDefaults(raw), GitTallyConfig::class.java)
+            }
+        return defaultPublicBaseUrl(config)
+    }
+
+    /** Legacy default: an empty `server.publicBaseUrl` becomes `https://<nginx.serverName>/`. */
+    private fun defaultPublicBaseUrl(config: GitTallyConfig): GitTallyConfig {
+        if (config.server.publicBaseUrl.isNotBlank() ||
+            config.server.nginx.serverName
+                .isBlank()
+        ) {
+            return config
         }
+        return config.copy(server = config.server.copy(publicBaseUrl = "https://${config.server.nginx.serverName}/"))
     }
 
     fun loadRaw(workingDir: Path = Paths.get(".")): Map<String, Any?> {