youngle.au — vhost + TLS for 11 subdomains

Young's directive (2026-10-21): create certbot/TLS + nginx vhost + public-hostname for youngle.au and 11 subdomains, all pointing at 161.33.71.67. Also: sol.youngle.au must NOT be public; auth.youngle.au had an SSL cert error.

The two problems found

sol.youngle.au was not live — but looked like it was

There was no nginx vhost and no listener for it. DNS pointed at prod, so requests hit nginx's first 443 server block (docs), which returned a redirect to Authelia. That reads as "a site that redirects" — not as "nothing is served here". It was never decommissioned in nginx; it was never configured either.

auth.youngle.au served the wrong certificate

Authelia's config declared authelia_url: https://auth.youngle.au, but no vhost served that hostname. With no default_server on :443, nginx answered every unmatched hostname with the first 443 block — the docs vhost — so the TLS handshake presented CN=docs.youngle.au. Hence the cert error, and the same mechanism made 6 of the 11 subdomains fail the TLS handshake entirely (HTTP 000).

What was done

1. ACME webroot — /var/www/certbot served from a new sites-enabled/acme-webroot.conf (default_server on :80), plus an acme-challenge location added to the docs/pulse/yukonit :80 blocks. yukonit's ACME location pointed at the wrong webroot (/var/www/html) — fixed.
2. One SAN cert — certbot certonly --webroot --cert-name youngle covering youngle.au + all 10 subdomains. Issued 2026-10-21, expires 2027-01-19. Auto-renew verified (certbot renew --dry-run → success).
3. Six new vhosts created and enabled:

   vhost	serves	gate
   auth.youngle.au	Authelia SSO portal (:9091)	bypass (public — it IS the login)
   sol.youngle.au	nothing — return 444 (connection dropped)	retired
   www.youngle.au	tenant landing (:8091)	public
   chat.youngle.au	chat UI (:8092)	public
   eve.youngle.au	EVE receptionist (:8092)	public
   solos.youngle.au	fleet console (:8091)	Authelia one_factor

4. Authelia access_control rewritten to state each surface explicitly (public bypass vs gated one_factor) rather than relying on the *.youngle.au wildcard, which would have gated the public storefronts too.

Verified (live, from LAB)

The lesson (worth recording)

One missing vhost became a 404 that looked like a redirect, and a missing default_server on :443 became a cert served to the wrong hostname. Both were invisible in the vhost listing and only appeared when a hostname was requested that had no server block of its own.

The guard: auth.youngle.au had a config pointing at it in Authelia but no server block. A config that names a hostname the proxy does not serve is the earliest signal — and it is exactly what a per-hostname probe catches.

Update (Young, 2026-10-21 later): youngle.au is the default cert

Young's rule: "default domain: youngle.au. Make youngle.au as default for cert and any subdomain will follow it."

What changed

1. Re-issued the cert under the name youngle.au (was youngle) — same SAN set, now the canonical cert name. certbot renew --dry-run passes.
2. Every vhost now points at /etc/letsencrypt/live/youngle.au/ — docs, pulse, yukonit, web, auth, chat, eve, sol, solos, www. One cert, one renewal.
3. 00-default.conf added — a default_server on :80 and :443 with server_name _:
   • serves the youngle.au cert for any hostname without its own vhost
   • location / { return 444; } — an unknown host is dropped, not served
   • serves the ACME challenge path, so any future subdomain can be certified without touching a vhost first
4. youngle.au apex vhost created — the tenant landing page (:8091), public.
5. storefront-youngle-au.conf enabled (it never was — web.youngle.au was silently falling through to the old default). Now on the youngle.au cert.

The 444 default is the point

Before this change there was no default_server on :443, so every unmatched hostname was answered by the first 443 block (docs) — which presented the docs certificate. That is what produced the auth.youngle.au SSL error. Now an unmatched hostname gets the right cert and a dropped connection, which is the honest answer for a host that does not exist.

Verified (live)

The wildcard — what I could NOT do, and why

*.youngle.au (covering any subdomain, including ones not yet named) needs DNS-01 challenge. HTTP-01 cannot prove a wildcard — Let's Encrypt refuses it, as measured: "Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA."

DNS for youngle.au is at Amazon Route 53 (ns1-3.partnerconsole.net). A DNS-01 wildcard cert therefore needs Route 53 API credentials (an IAM user with route53:ChangeResourceRecordSets on the hosted zone) plus the certbot Route 53 plugin. We have no such credential on LAB or prod — I checked the profile .env files, ~/.aws, and the shell environment.

So today: any subdomain must be added to the SAN list (one certbot --expand command, which renewals keep) or given its own cert. The moment Route 53 credentials exist, one command swaps in a wildcard that covers every subdomain permanently.

This is a credential procurement step, not a code step — and it belongs to the same lane as the other keys we hold.

Still open

• youngle.au apex itself has a cert but no vhost (not requested — say if wanted)
• docs.youngle.au and pulse.youngle.au still use their old individual certs (both valid). The SAN cert covers them; consolidating is cosmetic.
• chat.youngle.au points at :8092 (pulse-site) — a placeholder until the real chat service is named.
• eve.youngle.au points at :8092 (pulse-site) — placeholder. The EVE agent containers are on tenant networks with no host port by design; exposing one needs a deliberate routing decision.