another couple of hours wasted trying to fix @letsencrypt and @gitlab, I think Ill just buy a certificate and apply it onto the subdomain…