mTLS: fix Nix client cert config to use substituter URL params ssl-cert-file is for the CA bundle that verifies the server, not for client certificates. ssl-key-file does not exist in Nix. Client certs must be passed as tls-certificate and tls-private-key query parameters on the substituter URL (available since Nix 2.34).
mTLS: note subject DN format differences
mTLS: document native TLS termination
mTLS: document --mtls-bound-subject-read for private read proxy
Split mTLS into its own page