ops(pfi-tacticalrmm): *.phasefinal.com renews via dns-cloudflare (was manual; 16 days from expiry)

servers/pfi-tacticalrmm/README.md

@@ -18,6 +18,26 @@ Tactical RMM (remote monitoring + management) server at the Anaheim colo.
 [TacticalRMM](https://tacticalrmm.com/) — open-source RMM platform.
 Monitors and manages endpoints, pushes patches, runs scripts, etc.
 
+## TLS certificate — `*.phasefinal.com`, auto-renewing since 2026-10-05
+
+- nginx serves the Let's Encrypt wildcard from `/etc/letsencrypt/live/phasefinal.com` for rmm, rmm-api and rmm-mesh
+  (`:443`). It is nginx's only consumer: NATS runs without TLS behind nginx. MeshCentral's AMT/CIRA listener on
+  `:4433` has its own self-signed certificate (valid to 2049) and does not depend on this one.
+- **It used to be issued by hand** (`authenticator = manual`), which can never auto-renew. Found 2026-10-05 with 16
+  days left (it expired 2026-10-21). Now `certbot.timer` renews it with **dns-cloudflare**:
+  - credentials: `/etc/letsencrypt/cloudflare-phasefinal.ini` (root 0600)
+  - token: Cloudflare account token `pfi-tacticalrmm-certbot-dns01` (id `9f83ca60…`), Zone Read + DNS Write on
+    **phasefinal.com only**, minted with infra-ops's token-creator and vaulted as
+    `pfi-tacticalrmm/cloudflare-certbot-dns01-token`
+  - deploy hook: `/etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh`
+  - reissued 2026-10-05, expires 2027-01-03. `certbot renew --dry-run` passes. Pre-change renewal conf:
+    `/root/phasefinal.com.conf.pre-dns-cloudflare-20261005`.
+- The stale lineage `phasefinal.com-0001` (apex only, expired 2025-07-06) was deleted. Its renewal failure was half of
+  what made `certbot.service` fail daily.
+- ⚠ `/etc/nginx/sites-enabled/meshcentral.conf.bak-20261002-upload` is a backup file sitting in `sites-enabled`, so
+  nginx loads it (`conflicting server name "rmm-mesh.phasefinal.com" on :80, ignored`). Harmless today; move it out
+  when convenient.
+
 ## MeshCentral (bundled with TacticalRMM) — facts checked 2026-10-02
 
 - Runs natively (`meshcentral.service`, user `tactical`, `/meshcentral`), Node 18.20.8, MeshCentral 1.2.0,