Questions

The log is empty. Is it running?

The default level is warn and routine operation produces no output. Check the unit state rather than the log.

Why did a reload not apply my change?

Reload rereads configuration but does not rebind sockets. Changing the listening address or port requires a full restart.

How are certificates renewed?

Renewal runs from a timer twice a day and does nothing until the certificate is within thirty days of expiry. It writes to a staging directory and swaps atomically, so a failed renewal leaves the previous certificate in place.

How much disk do logs take?

Rotation keeps a week compressed, normally well under a hundred megabytes. The journal has its own budget and is capped separately.

Is a backup useful if it was never restored?

No. A backup that has not been restored at least once is an assumption, not a backup.