---
id: S01
parent: M003
milestone: M003
provides:
  - https://chrysopedia.com public endpoint with valid SSL
requires:
  []
affects:
  []
key_files:
  - (none)
key_decisions:
  - nginx config on nuc01 at /etc/nginx/sites-enabled/chrysopedia.com.conf
  - SSL via certbot with auto-renewal
patterns_established:
  - XPLTD domain setup: AdGuard rewrite → 10.0.0.9, nginx on nuc01, certbot SSL
observability_surfaces:
  - https://chrysopedia.com/health — public health endpoint
drill_down_paths:
  - .gsd/milestones/M003/slices/S01/tasks/T01-SUMMARY.md
duration: ""
verification_result: passed
completed_at: 2026-03-30T02:10:15.149Z
blocker_discovered: false
---

# S01: Domain Setup — DNS, Reverse Proxy, SSL

**chrysopedia.com live with AdGuard DNS, nginx reverse proxy, and Certbot SSL**

## What Happened

Configured chrysopedia.com end-to-end: AdGuard DNS rewrites (chrysopedia.com + www to 10.0.0.9), nginx reverse proxy on nuc01 (proxy_pass to 10.0.0.10:8096), and Certbot SSL cert. The AD DNS already had a CNAME for chrysopedia.com → dyndns.xpltd.co → public IP, so external access was pre-configured. https://chrysopedia.com is live with HTTP/2 and security headers.

## Verification

https://chrysopedia.com returns 200 with valid SSL, health endpoint accessible through domain

## Requirements Advanced

None.

## Requirements Validated

None.

## New Requirements Surfaced

None.

## Requirements Invalidated or Re-scoped

None.

## Deviations

www.chrysopedia.com skipped from SSL cert due to missing external CNAME.

## Known Limitations

www.chrysopedia.com not covered by SSL cert — needs external CNAME record.

## Follow-ups

Add CNAME record for www.chrysopedia.com at Namecheap and re-run certbot to include www.

## Files Created/Modified

None.
