Nginx Manager Certs

Sorry... more confusion :thinking:
Q. Which system will be running certbot?
Q. Which system will be terminating the inbound TLS connections?
[I think I know but want NOT to assume anything]