runbook stubs

on-call only

# cert
systemctl status certbot.timer
# edge reload
nginx -t && systemctl reload nginx