jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document Portainer :9443 HSTS/self-signed-cert conflict

Browse Source 
Firefox refuses https://alpha.jayfield.org:9443 with
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT and no click-through: the
includeSubDomains HSTS policy on the real alpha.jayfield.org vhost pins
the hostname to trusted-cert-only HTTPS on every port, but Portainer
still serves its stock self-signed cert directly on 9443. Records the
root cause and the planned reverse-proxy fix; no server changes made yet.
This commit is contained in:
jens
2026-07-20 00:08:34 +02:00
parent 92d871f2da
commit 4644c983ff
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -1
View File
@@ -108,7 +108,7 @@ SNI/Host headers, not a real trusted hostname a browser could pin.
| Container | Image | Ports | Purpose |
|---|---|---|---|
| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` |
| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` directly on its stock self-signed cert (**broken in HSTS-enforcing browsers**, see "Open items" below; planned fix is a `portainer.jayfield.org` reverse-proxy vhost, not yet applied) |
| `web` | `nginx:latest` | `127.0.0.1:8081` (localhost-only, not published externally) | Backing service for `web.jayfield.org`; only reachable through the Apache reverse proxy |
| `nextcloud` | `nextcloud:apache` | `127.0.0.1:8082` (localhost-only) | Nextcloud app (PHP+Apache bundled in the image); backing service for `cloud.jayfield.org` |
| `nextcloud-db` | `mariadb:lts` | internal only (`nextcloud_net`) | Dedicated DB for Nextcloud — kept separate from the host's own MySQL (which only holds `vmail`) |
@@ -217,6 +217,18 @@ endpoint instead of a bespoke Apache-WebDAV + SFTP-upload pipeline:
## Open items / known quirks
- **Portainer `:9443` UI unreachable in HSTS-enforcing browsers** — found
2026-07-20 when Firefox refused `https://alpha.jayfield.org:9443` with
`MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` and no click-through exception.
Cause: the `includeSubDomains` HSTS policy sent by the real
`alpha.jayfield.org` vhost pins the hostname to HTTPS-with-a-trusted-cert
on *every* port, but Portainer still answers `9443` directly with its own
self-signed cert — not a MITM, a self-inflicted interaction between two
otherwise-correct pieces of config. Planned fix: move Portainer behind an
Apache reverse proxy on its own subdomain (`portainer.jayfield.org`),
same pattern as `web.jayfield.org`/`cloud.jayfield.org`. See `TODO.md`
for the concrete steps; not yet applied.
- **Intranet migration from `vlda-01` (files, Gitea, Jellyfin, Dogecoin
node/wallet)** — planning stage only, not started. See `SYNC-PLAN.md`
for the full per-service design, open questions, and build order.
TODO.md
+21
View File
@@ -61,6 +61,27 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
`sshd -t`, applied via `systemctl reload sshd`, verified live with
`sshd -T` and a fresh key-only connection before considering it done.
- [ ] **Portainer's `:9443` UI is unreachable in HSTS-enforcing browsers** — found 2026-07-20
`https://alpha.jayfield.org:9443` throws
`MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` in Firefox with no click-through
option ("keine Ausnahme kann hinzugefügt werden"). Root cause: the
`includeSubDomains` HSTS policy sent by the real `alpha.jayfield.org`
vhost (`Strict-Transport-Security` header, added in the item above)
pins the *hostname* to HTTPS-with-a-trusted-cert on every port, but
Portainer (`README.md` §Docker services) still serves its stock
self-signed cert directly on `9443`. Not a MITM — self-inflicted by
combining HSTS with an unproxied self-signed service.
Planned fix (not yet applied): rebind Portainer's published port to
`127.0.0.1:9443:9443`, add a `portainer.jayfield.org` Apache vhost
(`ProxyPass`/`ProxyPassReverse` to `https://127.0.0.1:9443/`,
`SSLProxyEngine on`, `SSLProxyVerify none` for the loopback hop),
issue a real cert via `certbot --apache -d portainer.jayfield.org`,
and add the standard HSTS header — same pattern already used for
`web.jayfield.org`/`cloud.jayfield.org` (`SETUP.md` §4/§5). DNS needs
a new `portainer` A record in `db.jayfield.org` first (SOA serial
bump). Leave the `8000` edge-agent tunnel port as-is — no evidence
it's in use.
- [x] **fail2ban: `sshd` jail was evadable via low-and-slow attempts** — done 2026-07-19
Default `findtime=30m`/`maxretry=3` never triggered for `47.76.192.176`,
which had been hitting `root`/`jayfield` logins roughly every 33 minutes