Short write-ups, kept for my own reference.
Test first, reload second. nginx -t before systemctl reload nginx, and keep the
previous config around for a day. Static site blocks are the easy part; the awkward one is anything that
terminates TLS, because the certificate paths have to stay valid across the reload.
Under a steady load the case gets warm enough to be worth watching. Cleaning the vents bought a few degrees. I log the temperature every few minutes and mostly ignore it until it crosses a threshold.
I keep coming back to running a resolver on the LAN. It fixes a handful of names, caches the rest, and then I forget about it for a year until something upstream changes and it breaks quietly.