diff --git a/README.md b/README.md
index 086be37..64fdf03 100644
--- a/README.md
+++ b/README.md
@@ -2,12 +2,53 @@
 
 A URL shortener and (maybe) a pastebin server for our #ru community.
 
-## Build instructions
+## Building
 
 - `go get -u github.com/go-bindata/go-bindata/...`
 - `go generate ./...`
 - `go build ./cmd/rushlink`
 
+## Deploying
+
+We recommend running `rushlink` behind a reverse proxy suitable for processing
+HTTP requests, such as `nginx`, or `haproxy`.
+
+## Sample `nginx` config
+
+```
+server {
+    location / {
+        root    /var/www/rushlink;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header Host rushlink.local;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+    }
+}
+```
+
+`rushlink` automatically detects whether `http` or `https` is used when
+`X-Forwarded-Proto` is correctly set. Otherwise, pass `-root_url
+https://rushlink.local` to the binary (e.g. in the `systemd` unit file).
+
+## Sample `systemd` unit file
+
+```
+[Install]
+WantedBy=nginx.service
+
+[Service]
+Type=simple
+User=rushlink
+Group=nogroup
+ExecStart=/var/lib/rushlink/rushlink -database /var/lib/rushlink/db -file-store /var/lib/rushlink/filestore -root_url https://rushlink.local
+```
+
+---
+
+# Background
+
 ## Libraries
 
 Use standard-Go-libraries if the job can be done with those. As of now, these
@@ -24,7 +65,7 @@ are the exceptions:
 
 ## Database
 
-We will be using [`go.etcd.io/bbolt`]. This file should be the *only* file
+We use [`go.etcd.io/bbolt`]. This file should be the *only* file
 apart from our monolithic binary. All settings and keys should go in here.
 Any read-only data resides in the binary file (possibly compressed).
 
@@ -105,17 +146,3 @@ header that the client sends. We can still wrap the plain-text page in a single
 We will try as hard as possible to not store any data about our users, and will
 only provide any data when we have the legal obligation to do so.
 
-## Sample `nginx` config
-
-```
-server {
-    location / {
-        root    /var/www/rushlink;
-        proxy_pass http://127.0.0.1:8000;
-        proxy_set_header Host rushlink.local;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_http_version 1.1;
-    }
-}
-```
-