jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document Portainer :9443 HSTS/self-signed-cert conflict

Browse Source 
Firefox refuses https://alpha.jayfield.org:9443 with
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT and no click-through: the
includeSubDomains HSTS policy on the real alpha.jayfield.org vhost pins
the hostname to trusted-cert-only HTTPS on every port, but Portainer
still serves its stock self-signed cert directly on 9443. Records the
root cause and the planned reverse-proxy fix; no server changes made yet.
This commit is contained in:
jens
2026-07-20 00:08:34 +02:00
parent 92d871f2da
commit 4644c983ff
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -1
View File
@@ -108,7 +108,7 @@ SNI/Host headers, not a real trusted hostname a browser could pin.
| Container | Image | Ports | Purpose |
|---|---|---|---|
| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` |
| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` directly on its stock self-signed cert (**broken in HSTS-enforcing browsers**, see "Open items" below; planned fix is a `portainer.jayfield.org` reverse-proxy vhost, not yet applied) |
| `web` | `nginx:latest` | `127.0.0.1:8081` (localhost-only, not published externally) | Backing service for `web.jayfield.org`; only reachable through the Apache reverse proxy |
| `nextcloud` | `nextcloud:apache` | `127.0.0.1:8082` (localhost-only) | Nextcloud app (PHP+Apache bundled in the image); backing service for `cloud.jayfield.org` |
| `nextcloud-db` | `mariadb:lts` | internal only (`nextcloud_net`) | Dedicated DB for Nextcloud — kept separate from the host's own MySQL (which only holds `vmail`) |
@@ -217,6 +217,18 @@ endpoint instead of a bespoke Apache-WebDAV + SFTP-upload pipeline:
## Open items / known quirks
- **Portainer `:9443` UI unreachable in HSTS-enforcing browsers** — found
2026-07-20 when Firefox refused `https://alpha.jayfield.org:9443` with
`MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` and no click-through exception.
Cause: the `includeSubDomains` HSTS policy sent by the real
`alpha.jayfield.org` vhost pins the hostname to HTTPS-with-a-trusted-cert
on *every* port, but Portainer still answers `9443` directly with its own
self-signed cert — not a MITM, a self-inflicted interaction between two
otherwise-correct pieces of config. Planned fix: move Portainer behind an
Apache reverse proxy on its own subdomain (`portainer.jayfield.org`),
same pattern as `web.jayfield.org`/`cloud.jayfield.org`. See `TODO.md`
for the concrete steps; not yet applied.
- **Intranet migration from `vlda-01` (files, Gitea, Jellyfin, Dogecoin
node/wallet)** — planning stage only, not started. See `SYNC-PLAN.md`
for the full per-service design, open questions, and build order.