xn--e1afmapc4af.xn--p1af was wrong; correct punycode is xn----8sbfwtmcso8g.xn--p1ai. generate-nginx-conf.sh now converts IDN domains to punycode before expanding the template, so cert paths and server_name directives are always ASCII-safe. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>