Document Portainer :9443 HSTS/self-signed-cert conflict

Firefox refuses https://alpha.jayfield.org:9443 with
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT and no click-through: the
includeSubDomains HSTS policy on the real alpha.jayfield.org vhost pins
the hostname to trusted-cert-only HTTPS on every port, but Portainer
still serves its stock self-signed cert directly on 9443. Records the
root cause and the planned reverse-proxy fix; no server changes made yet.

TODO.md

@@ -61,6 +61,27 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       `sshd -t`, applied via `systemctl reload sshd`, verified live with
       `sshd -T` and a fresh key-only connection before considering it done.
 
+- [ ] **Portainer's `:9443` UI is unreachable in HSTS-enforcing browsers** — found 2026-07-20
+      `https://alpha.jayfield.org:9443` throws
+      `MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` in Firefox with no click-through
+      option ("keine Ausnahme kann hinzugefügt werden"). Root cause: the
+      `includeSubDomains` HSTS policy sent by the real `alpha.jayfield.org`
+      vhost (`Strict-Transport-Security` header, added in the item above)
+      pins the *hostname* to HTTPS-with-a-trusted-cert on every port, but
+      Portainer (`README.md` §Docker services) still serves its stock
+      self-signed cert directly on `9443`. Not a MITM — self-inflicted by
+      combining HSTS with an unproxied self-signed service.
+      Planned fix (not yet applied): rebind Portainer's published port to
+      `127.0.0.1:9443:9443`, add a `portainer.jayfield.org` Apache vhost
+      (`ProxyPass`/`ProxyPassReverse` to `https://127.0.0.1:9443/`,
+      `SSLProxyEngine on`, `SSLProxyVerify none` for the loopback hop),
+      issue a real cert via `certbot --apache -d portainer.jayfield.org`,
+      and add the standard HSTS header — same pattern already used for
+      `web.jayfield.org`/`cloud.jayfield.org` (`SETUP.md` §4/§5). DNS needs
+      a new `portainer` A record in `db.jayfield.org` first (SOA serial
+      bump). Leave the `8000` edge-agent tunnel port as-is — no evidence
+      it's in use.
+
 - [x] **fail2ban: `sshd` jail was evadable via low-and-slow attempts** — done 2026-07-19
       Default `findtime=30m`/`maxretry=3` never triggered for `47.76.192.176`,
       which had been hitting `root`/`jayfield` logins roughly every 33 minutes