From 2c4c7ca9aef91a26ff424a551882904a2951b33d Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Mon, 5 Oct 2026 18:38:08 -0700 Subject: [PATCH] ops(esh-docker-vm): Homepage on https via a file-provider Traefik router; note the dead Route53 ACME resolver --- servers/esh-docker-vm/README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/servers/esh-docker-vm/README.md b/servers/esh-docker-vm/README.md index 816da7b..e3a8396 100644 --- a/servers/esh-docker-vm/README.md +++ b/servers/esh-docker-vm/README.md @@ -9,6 +9,15 @@ General-purpose Docker host at the **ESH home-lab site** (`esteban.net` / `10.0. - **Subnet:** `10.0.50.0/24` (inferred from macvlan config) - **SSH:** standard port 22 - **Traefik entrypoints:** 80/443 terminate here; DNS-01 challenge via AWS Route53; protected by CrowdSec Traefik plugin +- **Homepage answers on HTTPS too** (2026-10-05, Prime): `https://10.0.50.45/` (also `eshhome`, `eshhome.esteban.net`). + The router is a file-provider one, `/opt/docker/conf/traefik-esh/homepage-https.yml` (websecure, `tls: {}`, service + `homepage@docker`), so the homepage container was not recreated (see the wedge section below). It serves Traefik's + default self-signed cert, since an IP cannot get a publicly trusted one: expect a one-time browser warning. + HTTP on `:80` and `:5100` is unchanged. +- ⚠ **The `pfi` ACME resolver is dead.** It uses Route53 DNS-01, but phasefinal.com moved to Cloudflare, and esteban.net + is at world4you. Its only stored cert, `vaultwarden.phasefinal.com`, expired 2025-12-31 and fails renewal daily in + the traefik log. No current router appears to depend on it. A trusted HTTPS name here would need a Cloudflare DNS-01 + resolver (one-zone token, as pfi-tacticalrmm has) plus a phasefinal.com name with an AdGuard internal rewrite. ## Hardware