From d1f739f66bcbbe5a12f52924e59cb4ec30734667 Mon Sep 17 00:00:00 2001 From: Spendlik Date: Tue, 11 Aug 2026 09:42:12 +0000 Subject: [PATCH] =?UTF-8?q?Mark=20Phases=207=20(SSL)=20and=208=20(DNS)=20c?= =?UTF-8?q?omplete=20for=20CT=20114=20=E2=80=94=20cert=20issued,=20DNS=20C?= =?UTF-8?q?NAME=20record=20ID=20340219244=20logged?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 114_koillection_deployment.md | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/114_koillection_deployment.md b/114_koillection_deployment.md index 80e9436..cfcde2a 100644 --- a/114_koillection_deployment.md +++ b/114_koillection_deployment.md @@ -1,6 +1,6 @@ # 114 — Koillection Deployment Guide -> Status: **IN PROGRESS** — CT created 2026-08-11, app stack + nginx reverse proxy live on HTTP, SSL/DNS/Authelia pending (Phase 7+) +> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia decision + first login pending (Phase 9+) > CT ID: 114 · IP: 192.168.1.114 > Domain: `collections.spendlik.sk` > Last updated: 2026-08-11 @@ -272,7 +272,7 @@ Confirmed: `nginx -t` → syntax ok, config test successful, reload applied clea --- -## Phase 7 — SSL Certificate +## Phase 7 — SSL Certificate ✅ DONE (2026-08-11) Still in CT 101: @@ -280,13 +280,9 @@ Still in CT 101: certbot --nginx -d collections.spendlik.sk ``` -> ⚠️ Always inspect the config after certbot: +Certificate issued successfully, expires 2026-11-09, auto-renewal scheduled by certbot. -```bash -cat /etc/nginx/sites-available/collections.spendlik.sk -``` - -Check for duplicate `server_name` directives and missing closing braces. Fix manually if needed. +Config inspected after issuance — **no corruption this time**: two `server_name collections.spendlik.sk;` lines are expected (one in the port-80 redirect block, one in the port-443 SSL block, matching the verified-good structure already used by CT 111 Paperless). Brace counts balance correctly in both blocks. Also set `HTTPS_ENABLED=1` in `/opt/koillection/.env` in CT 114, then restart: @@ -297,22 +293,21 @@ nano .env # set HTTPS_ENABLED=1 docker compose restart koillection ``` +> ⚠️ Required — without this, Koillection generates internal links as `http://`, which combined with the nginx 80→443 redirect causes a redirect loop. + --- -## Phase 8 — DNS Record +## Phase 8 — DNS Record ✅ DONE (2026-08-11) > ℹ️ **Updated 2026-08-10**: All `*.spendlik.sk` subdomains are now **CNAME** records pointing at the root `spendlik.sk`. Only the root `spendlik.sk` A record holds an IP — WebSupport rejects any duplicate IP value elsewhere in the zone. Do **not** create an A record for this subdomain. -In WebSupport admin panel: +CNAME record created: `collections.spendlik.sk` → `spendlik.sk`, TTL 600, **record ID `340219244`**. Added to `00_index.md` DNS table. -1. Add **CNAME** record: `collections` → `spendlik.sk` -2. Check both DNS management pages -3. Note the numeric record ID -4. Add to `00_index.md` DNS table +Verified resolving via `nslookup collections.spendlik.sk` on CT 101 (canonical name → `spendlik.sk` → `95.102.127.184`). -> ✅ No DDNS updater step is needed for this subdomain. `ddns-update.sh` on CT 108 only updates the root A record on IP change; this CNAME resolves through automatically. - -> ⚠️ **Note**: certbot's HTTP-01 challenge (Phase 7) needs this DNS record to already resolve publicly. If Phase 7 hasn't been attempted yet, do Phase 8 (DNS) *before* Phase 7 (SSL) — the guide lists them in this order for documentation clarity, but in practice DNS must propagate first or certbot will fail domain validation. +> ✅ No DDNS updater step needed for this subdomain. `ddns-update.sh` on CT 108 only updates the root A record on IP change; this CNAME resolves through automatically. +> +> ⚠️ **Note for future deployments**: certbot's HTTP-01 challenge (Phase 7) needs DNS to already resolve publicly — do DNS *before* attempting SSL if it hasn't propagated yet. In this deployment, DNS (Phase 8) was done before Phase 7 for exactly this reason, even though the guide lists them in this numeric order for documentation clarity. ---