diff --git a/roles/vpn/files/config/acl.json b/roles/vpn/files/config/acl.json
index 9e54bd5..e92eb74 100644
--- a/roles/vpn/files/config/acl.json
+++ b/roles/vpn/files/config/acl.json
@@ -41,6 +41,11 @@
       "action": "accept",
       "src": ["group:friends"],
       "dst": ["group:sys:*"]
+    },
+    {
+      "action": "accept",
+      "src": ["group:rain"],
+      "dst": ["group:rain:*"]
     }
   ]
 }
diff --git a/roles/webservers/files/levi/https.rainrain.xyz.servconf b/roles/webservers/files/levi/https.rainrain.xyz.servconf
index 5485af1..87e5aac 100644
--- a/roles/webservers/files/levi/https.rainrain.xyz.servconf
+++ b/roles/webservers/files/levi/https.rainrain.xyz.servconf
@@ -1,6 +1,6 @@
 stream {
   map $ssl_preread_server_name $name {
-    *.rainrain.xyz  rainrainxyz;
+    .rainrain.xyz  rainrainxyz;
     default proxy;
   }