The configurator does not split the deploy into three instructions. It already asks where the site lives, HestiaCP or a bare Ubuntu server, and which stack it is, Next.js or Django. The domain and port from the form land in every part of one answer.
The certificate
On a bare VPS, Certbot issues the certificate with a webroot. Port 80 serves /.well-known/acme-challenge/ before it redirects to HTTPS. On Hestia the panel commands replace Certbot: issue Letʼs Encrypt, select the custom_app template, and rebuild the domain.
sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.comThe same port
docker-compose publishes that port on 127.0.0.1 only. Next.js keeps listening on 3000 inside the container, and Django runs Gunicorn on 8000. Nginx proxies the domain to the host port, so the config and the compose file share one number.