---
id: T01
parent: S01
milestone: M003
provides: []
requires: []
affects: []
key_files: []
key_decisions: ["SSL cert for chrysopedia.com only (no www — missing external DNS record)", "nginx config follows restraintmusic.com pattern with security headers and rate limiting"]
patterns_established: []
drill_down_paths: []
observability_surfaces: []
duration: ""
verification_result: "curl -sI https://chrysopedia.com returns HTTP/2 200 with valid SSL, health endpoint returns ok"
completed_at: 2026-03-30T02:09:58.028Z
blocker_discovered: false
---

# T01: chrysopedia.com live with SSL — AdGuard DNS, nginx reverse proxy on nuc01, Certbot cert issued

> chrysopedia.com live with SSL — AdGuard DNS, nginx reverse proxy on nuc01, Certbot cert issued

## What Happened
---
id: T01
parent: S01
milestone: M003
key_files:
  - (none)
key_decisions:
  - SSL cert for chrysopedia.com only (no www — missing external DNS record)
  - nginx config follows restraintmusic.com pattern with security headers and rate limiting
duration: ""
verification_result: passed
completed_at: 2026-03-30T02:09:58.028Z
blocker_discovered: false
---

# T01: chrysopedia.com live with SSL — AdGuard DNS, nginx reverse proxy on nuc01, Certbot cert issued

**chrysopedia.com live with SSL — AdGuard DNS, nginx reverse proxy on nuc01, Certbot cert issued**

## What Happened

Added chrysopedia.com and www.chrysopedia.com DNS rewrites to AdGuard via API (pointing to 10.0.0.9). Created nginx reverse proxy config on nuc01 following the restraintmusic.com pattern (proxy_pass to 10.0.0.10:8096, security headers, rate limiting). Ran certbot for SSL — cert issued for chrysopedia.com (www.chrysopedia.com skipped due to missing external DNS). Verified https://chrysopedia.com returns 200 with valid SSL from both internal (ub01) and external (public IP) access.

## Verification

curl -sI https://chrysopedia.com returns HTTP/2 200 with valid SSL, health endpoint returns ok

## Verification Evidence

| # | Command | Exit Code | Verdict | Duration |
|---|---------|-----------|---------|----------|
| 1 | `curl -sI https://chrysopedia.com --resolve chrysopedia.com:443:149.76.193.34 | head -5` | 0 | ✅ pass — HTTP/2 200 | 500ms |
| 2 | `curl -s https://chrysopedia.com/health --resolve chrysopedia.com:443:149.76.193.34` | 0 | ✅ pass — {status:ok, database:connected} | 400ms |
| 3 | `ssh ub01 'nslookup chrysopedia.com 10.0.0.10'` | 0 | ✅ pass — resolves to 10.0.0.9 | 300ms |


## Deviations

www.chrysopedia.com doesn't have an external DNS record so certbot was run for chrysopedia.com only (without www). The AD DNS already had a CNAME for chrysopedia.com → dyndns.xpltd.co, so external DNS was pre-configured.

## Known Issues

www.chrysopedia.com doesn't have an external CNAME/A record — certbot couldn't issue cert for it. Needs a CNAME from www.chrysopedia.com to chrysopedia.com at the registrar.

## Files Created/Modified

None.


## Deviations
www.chrysopedia.com doesn't have an external DNS record so certbot was run for chrysopedia.com only (without www). The AD DNS already had a CNAME for chrysopedia.com → dyndns.xpltd.co, so external DNS was pre-configured.

## Known Issues
www.chrysopedia.com doesn't have an external CNAME/A record — certbot couldn't issue cert for it. Needs a CNAME from www.chrysopedia.com to chrysopedia.com at the registrar.
