Spendlik/Claude_Homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark Phases 7 (SSL) and 8 (DNS) complete for CT 114 — cert issued, DNS CNAME record ID 340219244 logged

Browse Source
This commit is contained in:
Spendlik 2026-08-11 09:42:12 +00:00
parent ea3d47aee4
commit d1f739f66b
1 changed files with 12 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
114_koillection_deployment.md
View File

@ -1,6 +1,6 @@
# 114 — Koillection Deployment Guide
> Status: **IN PROGRESS** — CT created 2026-08-11, app stack + nginx reverse proxy live on HTTP, SSL/DNS/Authelia pending (Phase 7+)
> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia decision + first login pending (Phase 9+)
> CT ID: 114 · IP: 192.168.1.114
> Domain: `collections.spendlik.sk`
> Last updated: 2026-08-11
@ -272,7 +272,7 @@ Confirmed: `nginx -t` → syntax ok, config test successful, reload applied clea
---
## Phase 7 — SSL Certificate
## Phase 7 — SSL Certificate ✅ DONE (2026-08-11)
Still in CT 101:
@ -280,13 +280,9 @@ Still in CT 101:
certbot --nginx -d collections.spendlik.sk
```
> ⚠️ Always inspect the config after certbot:
Certificate issued successfully, expires 2026-11-09, auto-renewal scheduled by certbot.
```bash
cat /etc/nginx/sites-available/collections.spendlik.sk
```
Check for duplicate `server_name` directives and missing closing braces. Fix manually if needed.
Config inspected after issuance — **no corruption this time**: two `server_name collections.spendlik.sk;` lines are expected (one in the port-80 redirect block, one in the port-443 SSL block, matching the verified-good structure already used by CT 111 Paperless). Brace counts balance correctly in both blocks.
Also set `HTTPS_ENABLED=1` in `/opt/koillection/.env` in CT 114, then restart:
@ -297,22 +293,21 @@ nano .env # set HTTPS_ENABLED=1
docker compose restart koillection
```
> ⚠️ Required — without this, Koillection generates internal links as `http://`, which combined with the nginx 80→443 redirect causes a redirect loop.
---
## Phase 8 — DNS Record
## Phase 8 — DNS Record ✅ DONE (2026-08-11)
> ℹ️ **Updated 2026-08-10**: All `*.spendlik.sk` subdomains are now **CNAME** records pointing at the root `spendlik.sk`. Only the root `spendlik.sk` A record holds an IP — WebSupport rejects any duplicate IP value elsewhere in the zone. Do **not** create an A record for this subdomain.
In WebSupport admin panel:
CNAME record created: `collections.spendlik.sk` → `spendlik.sk`, TTL 600, **record ID `340219244`**. Added to `00_index.md` DNS table.
1. Add **CNAME** record: `collections` → `spendlik.sk`
2. Check both DNS management pages
3. Note the numeric record ID
4. Add to `00_index.md` DNS table
Verified resolving via `nslookup collections.spendlik.sk` on CT 101 (canonical name → `spendlik.sk` → `95.102.127.184`).
> ✅ No DDNS updater step is needed for this subdomain. `ddns-update.sh` on CT 108 only updates the root A record on IP change; this CNAME resolves through automatically.
> ⚠️ **Note**: certbot's HTTP-01 challenge (Phase 7) needs this DNS record to already resolve publicly. If Phase 7 hasn't been attempted yet, do Phase 8 (DNS) *before* Phase 7 (SSL) — the guide lists them in this order for documentation clarity, but in practice DNS must propagate first or certbot will fail domain validation.
> ✅ No DDNS updater step needed for this subdomain. `ddns-update.sh` on CT 108 only updates the root A record on IP change; this CNAME resolves through automatically.
>
> ⚠️ **Note for future deployments**: certbot's HTTP-01 challenge (Phase 7) needs DNS to already resolve publicly — do DNS *before* attempting SSL if it hasn't propagated yet. In this deployment, DNS (Phase 8) was done before Phase 7 for exactly this reason, even though the guide lists them in this numeric order for documentation clarity.
---