From 623862b9f81e357cd90ad0cb8110ab35fd810e4e Mon Sep 17 00:00:00 2001
From: Matthew Meszaros <meszmatew@gmail.com>
Date: Sun, 30 Aug 2026 00:21:16 -0700
Subject: [PATCH] feat: point every server block in deploy/nginx/warmbly.conf
 at one Let's Encrypt certificate under live/app.example.com and explain that
 it must be issued standalone before the site is enabled

---
 deploy/nginx/warmbly.conf | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/deploy/nginx/warmbly.conf b/deploy/nginx/warmbly.conf
index 5439e485..e086c82f 100644
--- a/deploy/nginx/warmbly.conf
+++ b/deploy/nginx/warmbly.conf
@@ -1,7 +1,10 @@
 # nginx site for a Docker-free Warmbly install: the two static frontends plus
 # reverse proxies for the API, the websocket, and the tracking service.
-# Replace example.com, then obtain certificates (certbot --nginx works as-is).
-# The proxied services bind localhost, so nothing but nginx is reachable.
+# Replace example.com. Every server block reads one certificate covering all
+# five names from /etc/letsencrypt/live/app.example.com/, so issue it first
+# (certbot certonly --standalone ... --cert-name app.example.com) or nginx
+# refuses the site. The proxied services bind localhost, so nothing but nginx
+# is reachable.
 
 map $http_upgrade $connection_upgrade {
     default upgrade;
@@ -28,8 +31,8 @@ server {
 server {
     listen 443 ssl http2;
     server_name admin.example.com;
-    ssl_certificate     /etc/letsencrypt/live/admin.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/admin.example.com/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
 
     root /opt/warmbly/admin;
     index index.html;
@@ -44,8 +47,8 @@ server {
 server {
     listen 443 ssl http2;
     server_name api.example.com;
-    ssl_certificate     /etc/letsencrypt/live/api.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
 
     client_max_body_size 50m;
     location / {
@@ -63,8 +66,8 @@ server {
 server {
     listen 443 ssl http2;
     server_name ws.example.com;
-    ssl_certificate     /etc/letsencrypt/live/ws.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/ws.example.com/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
 
     location / {
         proxy_pass http://127.0.0.1:4000;
@@ -83,8 +86,8 @@ server {
 server {
     listen 443 ssl http2;
     server_name t.example.com;
-    ssl_certificate     /etc/letsencrypt/live/t.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/t.example.com/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
 
     location / {
         proxy_pass http://127.0.0.1:3000;