[whyrusleeping]

The default pds packaging takes care of SSL, but thats not a requirement, just something we try to make easy for users.

Also at:// URIs are of the form at://DID/..., and your human readable handle is bound to your DID through DNS TXT records _atproto.roshangeorge.dev, but applications all know to render that as just roshangeorge.dev. That DID points to a document that specifies where your server lives, so the HTTPS/WSS routes can live wherever you want them to.

Also likes/replies/etc on your posts go in their authors repos not yours, your intuition is correct there.

[extraduder_ire]

You can authenticate a handle via a file in ./well-known/ at the domain too, which is how bluesky does it for their default handles.