ops(esh-docker-vm): Homepage on https via a file-provider Traefik router; note the dead Route53 ACME resolver

servers/esh-docker-vm/README.md

@@ -9,6 +9,15 @@ General-purpose Docker host at the **ESH home-lab site** (`esteban.net` / `10.0.
 - **Subnet:** `10.0.50.0/24` (inferred from macvlan config)
 - **SSH:** standard port 22
 - **Traefik entrypoints:** 80/443 terminate here; DNS-01 challenge via AWS Route53; protected by CrowdSec Traefik plugin
+- **Homepage answers on HTTPS too** (2026-10-05, Prime): `https://10.0.50.45/` (also `eshhome`, `eshhome.esteban.net`).
+  The router is a file-provider one, `/opt/docker/conf/traefik-esh/homepage-https.yml` (websecure, `tls: {}`, service
+  `homepage@docker`), so the homepage container was not recreated (see the wedge section below). It serves Traefik's
+  default self-signed cert, since an IP cannot get a publicly trusted one: expect a one-time browser warning.
+  HTTP on `:80` and `:5100` is unchanged.
+- ⚠ **The `pfi` ACME resolver is dead.** It uses Route53 DNS-01, but phasefinal.com moved to Cloudflare, and esteban.net
+  is at world4you. Its only stored cert, `vaultwarden.phasefinal.com`, expired 2025-12-31 and fails renewal daily in
+  the traefik log. No current router appears to depend on it. A trusted HTTPS name here would need a Cloudflare DNS-01
+  resolver (one-zone token, as pfi-tacticalrmm has) plus a phasefinal.com name with an AdGuard internal rewrite.
 
 ## Hardware