ops(esh-docker-vm): Homepage on https via a file-provider Traefik router; note the dead Route53 ACME resolver

2026-10-05 18:38:08 -07:00
parent 3429b5c55d
commit 2c4c7ca9ae
1 changed files with 9 additions and 0 deletions
@@ -9,6 +9,15 @@ General-purpose Docker host at the **ESH home-lab site** (`esteban.net` / `10.0.
 - **Subnet:** `10.0.50.0/24` (inferred from macvlan config)
 - **SSH:** standard port 22
 - **Traefik entrypoints:** 80/443 terminate here; DNS-01 challenge via AWS Route53; protected by CrowdSec Traefik plugin
 - **Homepage answers on HTTPS too** (2026-10-05, Prime): `https://10.0.50.45/` (also `eshhome`, `eshhome.esteban.net`).
  The router is a file-provider one, `/opt/docker/conf/traefik-esh/homepage-https.yml` (websecure, `tls: {}`, service
  `homepage@docker`), so the homepage container was not recreated (see the wedge section below). It serves Traefik's
  default self-signed cert, since an IP cannot get a publicly trusted one: expect a one-time browser warning.
  HTTP on `:80` and `:5100` is unchanged.
 - ⚠ **The `pfi` ACME resolver is dead.** It uses Route53 DNS-01, but phasefinal.com moved to Cloudflare, and esteban.net
  is at world4you. Its only stored cert, `vaultwarden.phasefinal.com`, expired 2025-12-31 and fails renewal daily in
  the traefik log. No current router appears to depend on it. A trusted HTTPS name here would need a Cloudflare DNS-01
  resolver (one-zone token, as pfi-tacticalrmm has) plus a phasefinal.com name with an AdGuard internal rewrite.
 ## Hardware