deploy: serve ACME challenge locally in abramsos vhost (proxy was swallowing it → certbot fail)

61068950c0eae253046faa80e000af1f1b9c5953 · 2026-08-18 14:50:36 -0700 · Steve

Files touched

M deploy/abramsos.agentabrams.com.nginx.conf

Diff

commit 61068950c0eae253046faa80e000af1f1b9c5953
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 18 14:50:36 2026 -0700

    deploy: serve ACME challenge locally in abramsos vhost (proxy was swallowing it → certbot fail)
---
 deploy/abramsos.agentabrams.com.nginx.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deploy/abramsos.agentabrams.com.nginx.conf b/deploy/abramsos.agentabrams.com.nginx.conf
index 65d0333..37e13e0 100644
--- a/deploy/abramsos.agentabrams.com.nginx.conf
+++ b/deploy/abramsos.agentabrams.com.nginx.conf
@@ -5,6 +5,9 @@
 server {
   listen 45.61.58.125:80;
   server_name abramsos.agentabrams.com;
+  # ACME challenge served locally (NOT proxied) so certbot can issue — the app's
+  # requireAuth would otherwise redirect the challenge to /signin and fail issuance.
+  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; }
   location / {
     proxy_pass http://100.82.17.107:9774;   # Steve's Mac (tailnet), AbramsOS :9774
     proxy_http_version 1.1;

← 6e958d9 deploy: nginx vhost for abramsos.agentabrams.com (Kamatera r · back to AbramsOS · deploy: abramsos vhost with fleet Basic Auth (admin/DW2024!) b2fd5b1 →