You generally just do certbot renew
without extra options. The renew uses the options stored in the renewal config file (in ../renewal/)
If in the future you use other methods putting --nginx on the renew would override them.
Are you sure --staging is correct here? That is fine for testing but gets a Staging cert which will not validate by production user-agents
Personally I would not rely on --nginx
as installer. I would use certonly --webroot
method and configure nginx manually. Then, use normal backup/restore of nginx config for its operation. If you store the certs for nginx in a separate folder (away from Certbot's folders) just backup those certs too to have a self-contained working nginx system.
Then, you operate Certbot just for getting/renewing the cert. Your nginx can run or be restored independently of a working Certbot install and function.
I say that because it is actually what I do (although I don't use Certbot but a different ACME Client with similar feature).
But, there is no one right answer here. Just further food for thought.