docs(mistakes): the www → apex recipe — CNAME, the silently self-signed cert, and the heredoc that ate $request_uri

www.llamacasty.com now resolves and 301s to the apex. Four traps worth keeping:
yunohost domain add --install-letsencrypt-cert exits SUCCESS with only a self-signed
cert (it skips LE when the parent has no wildcard), plain cert install then insists on
a diagnosis and needs --no-checks, a domain with no app 302s to the YunoHost SSO rather
than 404ing, and writing the nginx snippet over ssh with an unquoted heredoc silently
expands $request_uri to nothing — every path then redirects to the homepage. Also
recorded: both resolvers near this job lie about the name (workstation NXDOMAIN cache,
droplet dnsmasq answering ::1).

MyMistakes.md

@@ -68,6 +68,49 @@ Password comes in on **stdin** (`SITE_SUDO_PW=... ./deploy.sh`), never on a comm
 - ⚠️ Ports **22 and 1319 are closed**; 2214 is the only SSH door, and it is the *host*, not Gitea
   (Gitea pushes go over **HTTPS** with the credential helper — see `docs/ai/environment.md`).
 
+### POINTING www AT THE APEX ON THE YUNOHOST DROPLET (RECIPE, 2026-10-31)
+
+**Problem:** `www.llamacasty.com` did not resolve at all, and once a record existed the server half
+was four separate traps: YunoHost added the vhost with a **self-signed** cert, refused to issue
+Let's Encrypt without a diagnosis, and served the **SSO login** because the domain has no app.
+
+**1. DNS** — Namecheap BasicDNS, zone `llamacasty.com`. `www CNAME llamacasty.com.` (YunoHost's own
+subdomain example uses a CNAME per subdomain, and a CNAME follows the apex if the droplet IP moves;
+an `A www` record would need a second edit for every rebuild). The apex `A` is the only IP holder.
+
+**2. Domain + cert on the droplet:**
+
+```bash
+yunohost domain add www.llamacasty.com --install-letsencrypt-cert   # vhost + SELF-SIGNED cert
+yunohost domain cert install www.llamacasty.com --no-checks          # real LE cert
+```
+
+- ⚠️ The `--install-letsencrypt-cert` flag **does nothing here**: *"Skipping Let's Encrypt certificate
+  attempt because there's no wildcard configured on the parent domain's DNS records."* It exits
+  SUCCESS with a self-signed cert, so check `openssl s_client -servername <host>` afterwards.
+- ⚠️ Plain `yunohost domain cert install` refuses with *"no diagnosis result for domain … use
+  `--no-checks`"*. `--no-checks` is safe when the name resolves publicly — LE's HTTP-01 validation
+  is itself the DNS proof (it failed over to a real cert on the first attempt).
+
+**3. The redirect** — with no app installed the vhost 302s to `/yunohost/sso?r=…`, so a `301` is
+needed. YunoHost includes `/etc/nginx/conf.d/<domain>.d/*.conf` **inside the server{} block**;
+`location / { return 301 https://llamacasty.com$request_uri; }` there wins over SSO because `return`
+runs in the rewrite phase, before `access_by_lua_file` (the global SSO guard). The `.d` include
+survives YunoHost regenerating the `.conf`; never edit the `.conf` itself.
+
+- ⚠️ **The heredoc ate `$request_uri`.** Writing that file through `ssh "sudo bash -c 'cat > … <<EOF'"`
+  expands nginx's variable to empty and silently produces `return 301 https://llamacasty.com;` —
+  every path redirects to the homepage. Write the file **locally** and `scp` + `install -m 644` it.
+  (`printf "---x---"` in the same command also dies on `--`: *invalid option*.)
+- ⚠️ **Two resolvers lie about this name.** The workstation's resolver caches the old NXDOMAIN, and
+  on the droplet `getent hosts www.llamacasty.com` returns **`::1`** because YunoHost's dnsmasq
+  answers for its own vhosts. Neither is a DNS test — use a public DoH query or
+  `curl --resolve www.llamacasty.com:443:<ip>`.
+
+**Verify:** `curl --resolve www.llamacasty.com:443:143.244.176.131 -o /dev/null -w '%{http_code}
+%{redirect_url}' https://www.llamacasty.com/privacy.html` → `301 https://llamacasty.com/privacy.html`;
+the cert must read `CN=www.llamacasty.com`, issuer Let's Encrypt.
+
 ### CONVERTING A MEDIAPIPE .tflite (WITH CUSTOM OPS) TO ONNX — AND PROVING IT (RECIPE, TASK 51)
 
 **Problem:** MediaPipe segmentation models end in the custom op `Convolution2DTransposeBias`;