Document the workflow in the deployment guide and ignore secret-bearing backups under deploy/backups/.
Request apex and www from Let's Encrypt and serve both names in nginx.