[Kaliumhexacyanoferrat]

A lambda with a domain of its own now sends visitors of www. in front of it on to the domain: www.http-arena.com/page?x=1 → https://http-arena.com/page?x=1, permanently, so search engines keep one address.

• Where: LambdaRedirectConcern, beside the subdomain → domain redirect, ahead of everything else. A plain request goes straight to HTTPS on the domain. Moved Permanently for a read, Permanent Redirect for the rest, cached for a day.
• The owner decides the name: a domain entered with www. is served at that name, and nothing is sent to it from the name without.
• Never taken: a www. that is another lambda's domain, or one of the platform's own names, is left as it is.
• Cheap: DomainRegistry builds the www. names in the same reload as the domains, so a request does one more lookup in a frozen map.
• Editor: the domain section lists the A and AAAA records for www. beside the domain's, with a line saying they are optional and what they do. The text is translated into all 13 languages.
• README: the certbot command for a custom domain issues one certificate for both names. It also says to leave www. out where its DNS does not point at the server. CLAUDE.md records the decision.

Certificates

A www. name is only redirected once a browser trusts the server for it. A certificate already issued without www. keeps working for the domain. Until it is reissued with both names, visitors of its www. get the fallback certificate and a warning.

reissue-www.sh does this for every such certificate in /opt/genhttp-lambda/certs:

• it reissues through the web root, finding the certbot lineage by the names;
• it leaves out a www. whose DNS does not resolve to where its domain does, and names it;
• it installs the files.

It does not restart the server, so the deploy of this PR picks them up. Run --list or --dry-run first.

Tests

New tests in DomainTests:

• the redirect, for a read and for a POST;
• a domain entered with www.;
• a www. that is another lambda's domain;
• the platform's own name;
• removing the domain.

The full suite passes (838), and npm run build passes.

🤖 Generated with Claude Code