docs: document tls_cert option in getting_started and faq

Author: hpk42

doc/source/faq.rst

@@ -14,7 +14,12 @@ goes beyond what classic email servers offer:
 -  **Instant/Realtime:** sub-second message delivery, realtime P2P
    streaming, privacy-preserving Push Notifications for Apple, Google, and `Ubuntu Touch <https://docs.ubports.com/en/latest/appdev/guides/pushnotifications.html>`_;
 
--  **Security Enforcement**: only strict TLS, DKIM and OpenPGP with minimized metadata accepted
+-  **Security Enforcement**: only strict TLS, DKIM and
+   OpenPGP with minimized metadata accepted.
+   Relays using ``tls_cert = self``
+   still enforce TLS encryption for transport
+   while relying on OpenPGP end-to-end encryption
+   for message content protection.
 
 -  **Reliable Federation and Decentralization:** No spam or IP reputation checks, federating
    depends on established IETF standards and protocols.
@@ -44,8 +49,13 @@ automatically deployed and updated using `the chatmail relay
 repository <https://github.com/chatmail/relay>`__. Chatmail relays are
 composed of proven standard email server components, Postfix and
 Dovecot, and are configured to run unattended without much maintenance
-effort. Chatmail relays happily run on low-end hardware like a Raspberry
-Pi.
+effort. Chatmail relays happily run on low-end hardware
+like a Raspberry Pi.
+Setting ``tls_cert = self`` in ``chatmail.ini``
+enables running a relay with self-signed certificates,
+making it possible to operate on a LAN
+or behind a firewall
+without needing Let's Encrypt or a public domain.
 
 
 How trustable are chatmail relays?

doc/source/getting_started.rst

@@ -47,6 +47,12 @@ steps. Please substitute it with your own domain.
        www.chat.example.org. 3600 IN CNAME chat.example.org.
        mta-sts.chat.example.org. 3600 IN CNAME chat.example.org.
 
+   .. note::
+
+      For ``tls_cert = self`` deployments (see step 3),
+      the ``mta-sts`` CNAME and ``_mta-sts`` TXT records
+      are not needed.
+
 2. On your local PC, clone the repository and bootstrap the Python
    virtualenv.
 
@@ -63,6 +69,14 @@ steps. Please substitute it with your own domain.
 
        scripts/cmdeploy init chat.example.org  # <-- use your domain
 
+   To use self-signed TLS certificates
+   instead of Let's Encrypt,
+   set ``tls_cert = self`` in ``chatmail.ini``.
+   This is useful for private or test deployments
+   and does not require a publicly resolvable domain.
+   See the :doc:`overview`
+   for details on certificate provisioning.
+
 4. Verify that SSH root login to the deployment server server works:
 
    ::