Document Portainer :9443 HSTS/self-signed-cert conflict

Firefox refuses https://alpha.jayfield.org:9443 with
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT and no click-through: the
includeSubDomains HSTS policy on the real alpha.jayfield.org vhost pins
the hostname to trusted-cert-only HTTPS on every port, but Portainer
still serves its stock self-signed cert directly on 9443. Records the
root cause and the planned reverse-proxy fix; no server changes made yet.

README.md

@@ -108,7 +108,7 @@ SNI/Host headers, not a real trusted hostname a browser could pin.
 
 | Container | Image | Ports | Purpose |
 |---|---|---|---|
-| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` |
+| `portainer` | `portainer/portainer-ce:2.39.5` | `8000` (edge-agent tunnel, published), `9443` (HTTPS UI, published), `9000` (UI, internal only) | Docker management UI — `https://alpha.jayfield.org:9443` directly on its stock self-signed cert (**broken in HSTS-enforcing browsers**, see "Open items" below; planned fix is a `portainer.jayfield.org` reverse-proxy vhost, not yet applied) |
 | `web` | `nginx:latest` | `127.0.0.1:8081` (localhost-only, not published externally) | Backing service for `web.jayfield.org`; only reachable through the Apache reverse proxy |
 | `nextcloud` | `nextcloud:apache` | `127.0.0.1:8082` (localhost-only) | Nextcloud app (PHP+Apache bundled in the image); backing service for `cloud.jayfield.org` |
 | `nextcloud-db` | `mariadb:lts` | internal only (`nextcloud_net`) | Dedicated DB for Nextcloud — kept separate from the host's own MySQL (which only holds `vmail`) |
@@ -217,6 +217,18 @@ endpoint instead of a bespoke Apache-WebDAV + SFTP-upload pipeline:
 
 ## Open items / known quirks
 
+- **Portainer `:9443` UI unreachable in HSTS-enforcing browsers** — found
+  2026-07-20 when Firefox refused `https://alpha.jayfield.org:9443` with
+  `MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` and no click-through exception.
+  Cause: the `includeSubDomains` HSTS policy sent by the real
+  `alpha.jayfield.org` vhost pins the hostname to HTTPS-with-a-trusted-cert
+  on *every* port, but Portainer still answers `9443` directly with its own
+  self-signed cert — not a MITM, a self-inflicted interaction between two
+  otherwise-correct pieces of config. Planned fix: move Portainer behind an
+  Apache reverse proxy on its own subdomain (`portainer.jayfield.org`),
+  same pattern as `web.jayfield.org`/`cloud.jayfield.org`. See `TODO.md`
+  for the concrete steps; not yet applied.
+
 - **Intranet migration from `vlda-01` (files, Gitea, Jellyfin, Dogecoin
   node/wallet)** — planning stage only, not started. See `SYNC-PLAN.md`
   for the full per-service design, open questions, and build order.

TODO.md

@@ -61,6 +61,27 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       `sshd -t`, applied via `systemctl reload sshd`, verified live with
       `sshd -T` and a fresh key-only connection before considering it done.
 
+- [ ] **Portainer's `:9443` UI is unreachable in HSTS-enforcing browsers** — found 2026-07-20
+      `https://alpha.jayfield.org:9443` throws
+      `MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT` in Firefox with no click-through
+      option ("keine Ausnahme kann hinzugefügt werden"). Root cause: the
+      `includeSubDomains` HSTS policy sent by the real `alpha.jayfield.org`
+      vhost (`Strict-Transport-Security` header, added in the item above)
+      pins the *hostname* to HTTPS-with-a-trusted-cert on every port, but
+      Portainer (`README.md` §Docker services) still serves its stock
+      self-signed cert directly on `9443`. Not a MITM — self-inflicted by
+      combining HSTS with an unproxied self-signed service.
+      Planned fix (not yet applied): rebind Portainer's published port to
+      `127.0.0.1:9443:9443`, add a `portainer.jayfield.org` Apache vhost
+      (`ProxyPass`/`ProxyPassReverse` to `https://127.0.0.1:9443/`,
+      `SSLProxyEngine on`, `SSLProxyVerify none` for the loopback hop),
+      issue a real cert via `certbot --apache -d portainer.jayfield.org`,
+      and add the standard HSTS header — same pattern already used for
+      `web.jayfield.org`/`cloud.jayfield.org` (`SETUP.md` §4/§5). DNS needs
+      a new `portainer` A record in `db.jayfield.org` first (SOA serial
+      bump). Leave the `8000` edge-agent tunnel port as-is — no evidence
+      it's in use.
+
 - [x] **fail2ban: `sshd` jail was evadable via low-and-slow attempts** — done 2026-07-19
       Default `findtime=30m`/`maxretry=3` never triggered for `47.76.192.176`,
       which had been hitting `root`/`jayfield` logins roughly every 33 minutes