Include www subdomain in clearnet TLS issuance.

Request apex and www from Let's Encrypt and serve both names in nginx.

deploy/DEPLOYMENT_GUIDE.md

@@ -3,7 +3,7 @@
 ## 1. Requirements
 
 - Ubuntu 22.04+ or similar Linux with Docker Engine and the Compose plugin — follow [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository). Tested and recommended on Ubuntu 22.04 LTS.
-- A domain name pointing at your server (A record for clearnet HTTPS)
+- A domain name pointing at your server (A records for apex and `www`)
 
 ## 2. Server setup
 
@@ -106,7 +106,7 @@ Remove the temporary bootstrap certificates under `deploy/certs/live/` (Certbot
 rm -rf deploy/certs/live/*
 ```
 
-Request the real certificate:
+Request the real certificate (apex + www):
 
 ```bash
 ./deploy/scripts/issue-certs.sh --email you@example.com

deploy/scripts/issue-certs.sh

@@ -9,9 +9,9 @@ usage() {
     cat <<EOF
 Usage: $(basename "$0") --email you@example.com
 
-Obtain or renew Let's Encrypt certificates for CLEARNET_DOMAIN using the webroot
-challenge. Nginx must be running and serving /.well-known/acme-challenge/ from
-deploy/certbot/www.
+Obtain Let's Encrypt certificates for CLEARNET_DOMAIN and www.CLEARNET_DOMAIN using
+the webroot challenge. Nginx must be running and serving /.well-known/acme-challenge/
+from deploy/certbot/www.
 
 Environment is read from .env.prod (CLEARNET_DOMAIN).
 EOF
@@ -65,6 +65,7 @@ docker run --rm \
     --webroot \
     -w /var/www/certbot \
     -d "$CLEARNET_DOMAIN" \
+    -d "www.${CLEARNET_DOMAIN}" \
     --email "$CERTBOT_EMAIL" \
     --agree-tos \
     --non-interactive

nginx/conf.d/clearnet.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 80;
-    server_name ${CLEARNET_DOMAIN};
+    server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN};
 
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
@@ -13,7 +13,7 @@ server {
 
 server {
     listen 443 ssl;
-    server_name ${CLEARNET_DOMAIN};
+    server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN};
 
     ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem;
     ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem;