Files

defiQUG bea1903ac9

Deploy to Phoenix / deploy (push) Has been cancelled

Details

Sync all local changes: docs, config, scripts, submodule refs, verification evidence

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-02-21 15:46:06 -08:00

4.6 KiB

Raw Blame History

Let's Encrypt Certificate Setup - Complete Summary

Date: $(date)
Domain: rpc-core.d-bis.org
Status: ✅ FULLY COMPLETE AND OPERATIONAL

✅ All Tasks Completed

1. DNS Configuration ✅

✅ CNAME record created: rpc-core.d-bis.org → 52ad57a71671c5fc009edf0744658196.cfargotunnel.com
✅ Proxy enabled (🟠 Orange Cloud)
✅ DNS propagation complete

2. Cloudflare Tunnel Route ✅

✅ Tunnel route configured via API
✅ Route: rpc-core.d-bis.org → http://192.168.11.250:443
✅ Tunnel service reloaded

3. Let's Encrypt Certificate ✅

✅ Certificate obtained via DNS-01 challenge
✅ Issuer: Let's Encrypt (R12)
✅ Valid: Dec 22, 2025 - Mar 22, 2026 (89 days)
✅ Location: /etc/letsencrypt/live/rpc-core.d-bis.org/

4. Nginx Configuration ✅

✅ SSL certificate updated to Let's Encrypt
✅ SSL key updated to Let's Encrypt
✅ Configuration validated
✅ Service reloaded

5. Auto-Renewal ✅

✅ Certbot timer enabled
✅ Renewal test passed
✅ Will auto-renew 30 days before expiration

6. Verification ✅

✅ Certificate verified
✅ HTTPS endpoint tested and working
✅ Health check passing
✅ RPC endpoint responding correctly

📊 Final Configuration

DNS Record

Type: CNAME
Name: rpc-core
Target: 52ad57a71671c5fc009edf0744658196.cfargotunnel.com
Proxy: 🟠 Proxied
TTL: Auto

Tunnel Route

Hostname: rpc-core.d-bis.org
Service: http://192.168.11.250:443
Type: HTTP
Origin Request: noTLSVerify: true

SSL Certificate

Certificate: /etc/letsencrypt/live/rpc-core.d-bis.org/fullchain.pem
Private Key: /etc/letsencrypt/live/rpc-core.d-bis.org/privkey.pem
Issuer: Let's Encrypt
Valid Until: March 22, 2026

Nginx Configuration

ssl_certificate /etc/letsencrypt/live/rpc-core.d-bis.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/rpc-core.d-bis.org/privkey.pem;
server_name rpc-core.d-bis.org besu-rpc-1 192.168.11.250 rpc-core.besu.local rpc-core.chainid138.local;

🧪 Verification Results

Certificate Status

pct exec 2500 -- certbot certificates
# Result: ✅ Certificate found and valid

Certificate Details

Subject: CN=rpc-core.d-bis.org
Issuer: Let's Encrypt (R12)
Valid: Dec 22, 2025 - Mar 22, 2026

HTTPS Endpoint

curl -X POST https://rpc-core.d-bis.org \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
# Result: ✅ Responding correctly

Auto-Renewal Test

pct exec 2500 -- certbot renew --dry-run
# Result: ✅ Renewal test passed

Health Check

pct exec 2500 -- /usr/local/bin/nginx-health-check.sh
# Result: ✅ All checks passing

🔄 Methods Used

Primary Method: DNS-01 Challenge ✅

Status: Success
Method: Cloudflare API DNS-01 challenge
Advantage: Works with private IPs and tunnels
Auto-renewal: Fully automated

Alternative Methods Attempted

Cloudflare Tunnel (HTTP-01): DNS configured, tunnel route added
Public IP (HTTP-01): Attempted but not needed

📋 Complete Checklist

DNS CNAME record created
Cloudflare Tunnel route configured
Certbot DNS plugin installed
Cloudflare credentials configured
Certificate obtained (DNS-01)
Nginx configuration updated
Nginx reloaded
Auto-renewal enabled
Certificate verified
HTTPS endpoint tested
Health check verified
Renewal test passed
Tunnel service reloaded

🎯 Summary

Status: ✅ ALL TASKS COMPLETE

The Let's Encrypt certificate has been successfully installed and configured for rpc-core.d-bis.org. All components are operational:

✅ DNS configured (CNAME to tunnel)
✅ Tunnel route configured
✅ Certificate installed (Let's Encrypt)
✅ Nginx using Let's Encrypt certificate
✅ Auto-renewal enabled and tested
✅ All endpoints verified and working

The self-signed certificate has been completely replaced with a production Let's Encrypt certificate.

Completion Date: $(date)
Certificate Expires: March 22, 2026
Auto-Renewal: ✅ Enabled
Status: ✅ PRODUCTION READY

4.6 KiB Raw Blame History