These nginx config will serve `https://storkplus.com`, `https://auth-api.storkplus.com` and any subdomain of `storkplus.com`

NGINX config

# Storak Auth UI
server {
    listen 80;
    listen [::]:80;
    server_name storkplus.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name storkplus.com;

    root /var/www/html/storkplus_auth_ui;

    ssl_certificate /etc/letsencrypt/live/storkplus.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/storkplus.com-0001/privkey.pem;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        try_files $uri /index.html;
    }
}

# Storak Auth API
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name auth-api.storkplus.com;

    ssl_certificate /etc/letsencrypt/live/auth-api.storkplus.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/auth-api.storkplus.com/privkey.pem;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass http://localhost:3000;
    }
}

# Storak Plus (symfony)
server {
    listen 80;
    listen [::]:80;
    server_name *.storkplus.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name *.storkplus.com;

    root /var/www/html/storkplus_test;

    ssl_certificate /etc/letsencrypt/live/storkplus.com-0002/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/storkplus.com-0002/privkey.pem;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        try_files $uri /index.html;
    }
}

Autorenewal

By default certbot comes with auto-renewal enabled except for the wildcard certificate you need to make sure the CA need to validate you own the domain by appending TXT record on your domain

to check if autorenewal is working you can run sudo certbot renew --dry-run