diff --git a/Makefile b/Makefile
index a41c4ce..7b8d550 100644
--- a/Makefile
+++ b/Makefile
@@ -2,10 +2,14 @@
 # Clone with ssh keys:  git clone ssh://root@ping.wit.com/var/lib/git/website/jcarr/check.jcarr.wit.com
 
 all:
-	echo run setup
+	@echo
+	@echo 'make update # pulls down the submodule directories'
+	@echo 'make status # shows your letsencrypt cert'
+	@echo
 
 setup:
-	echo put stuff here
+	make status
+	ls -l /var/www/html
 
 push:
 	git add --all
@@ -22,3 +26,13 @@ resetgit:
 	mkdir myrepo
 	cd myrepo && touch .git/git-daemon-export-ok
 	cd myrepo && git config --bool core.bare true
+
+status:
+	@echo
+	acmetool status
+	@echo
+
+# this will update the cert when 'acmetool status' says 'needs-renewing'
+renew-cert:
+	service nginx stop
+	acmetool --xlog.severity=debug reconcile
diff --git a/gui/index.html b/gui/index.html
index a727fa8..a876c9b 100644
--- a/gui/index.html
+++ b/gui/index.html
@@ -2,9 +2,10 @@
 <html>
 <head>
 <meta charset="utf-8">
-<title>go.wit.com/gui</title>
-<meta name="go-import" content="go.wit.com/gui git https://github.com/witorg/gui">
-<meta name="go-source" content="go.wit.com/gui https://github.com/witorg/gui https://github.com/witorg/gui/tree/master{/dir} https://github.com/witorg/gui/blob/master{/dir}/{file}#L{line}">
+<title>check.lab.wit.org/gui</title>
+<meta name="go-import" content="check.lab.wit.org/gui git https://github.com/witorg/gui">
+<meta name="go-source" content="check.lab.wit.org/gui https://github.com/witorg/gui https://github.com/witorg/gui/tree/master{/dir} https://github.com/witorg/gui/blob/master{/dir}/{file}#L{line}">
+<!-- from view-source:http://go.atomizer.io/stream/ -->
 <style>
 * { font-family: sans-serif; }
 body { margin-top: 0; }
@@ -15,10 +16,11 @@ ul { margin-top: 16px; margin-bottom: 16px; }
 </head>
 <body>
 <div class="content">
-<h2>go.wit.com/gui</h2>
-<code>go get go.wit.com/gui</code>
-<code>import "go.wit.com/gui"</code>
-Home: <a href="https://godoc.org/go.wit.com/gui">https://godoc.org/go.wit.com/gui</a><br/>
+<h2>check.lab.wit.org/gui</h2>
+<code>go get check.lab.wit.org/gui</code>
+<code>go install -v check.lab.wit.org/gui</code>
+<code>import "check.lab.wit.org/gui"</code>
+Home: <a href="https://godoc.org/check.lab.wit.org/gui">https://godoc.org/check.lab.wit.org/gui</a><br/>
 Source: <a href="https://github.com/witorg/gui">https://github.com/witorg/gui</a><br/>
 </div>
 </body>
diff --git a/nginx/check.lab.wit.org.conf b/nginx/check.lab.wit.org.conf
new file mode 100644
index 0000000..0e12a8c
--- /dev/null
+++ b/nginx/check.lab.wit.org.conf
@@ -0,0 +1,91 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server;
+
+	# SSL configuration
+	#
+	listen 443 ssl default_server;
+	listen [::]:443 ssl default_server;
+
+	# rened on Jan 6 2022
+	# ssl_certificate /var/lib/acme/certs/324e3gzeycnvsbr5g4f45p7admosogydawnb2hajzo2wt4zjhfda/cert;
+	# ssl_certificate_key /var/lib/acme/certs/324e3gzeycnvsbr5g4f45p7admosogydawnb2hajzo2wt4zjhfda/privkey;
+	# ssl_certificate /var/lib/acme/certs/g4hu65hjgmxozs3dfh22k5vjaglibsjcuwee27rct2pjue54uyoq/cert;
+	# ssl_certificate_key /var/lib/acme/certs/g4hu65hjgmxozs3dfh22k5vjaglibsjcuwee27rct2pjue54uyoq/privkey;
+
+	ssl_certificate /var/lib/acme/live/check.lab.wit.org/cert;
+	ssl_certificate_key /var/lib/acme/live/check.lab.wit.org/privkey;
+
+	# include snippets/snakeoil.conf;
+
+	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}
