Certificate renewal¶
Public TLS in this fleet is split:
| surface | certificate | renewal |
|---|---|---|
Public HTTPS (public-domain services) |
Cloudflare edge certificates | automatic (Cloudflare) |
| Origin leg behind cloudflared | Cloudflare origin cert | installed once; re-manage when it approaches expiry |
Netbird control plane (<vpn-fqdn>) |
Let's Encrypt via embedded ACME clients | automatic; verify the dashboard answers after each bump |
Verified check¶
curl -sI https://<beszel-fqdn> | head -1
curl -sI https://<public-domain-app> | head -1
echo | openssl s_client -connect <vpn-fqdn>:443 2>/dev/null | openssl x509 -noout -dates
Renewal/lag signs¶
- A public route answers but with an expired cert → Cloudflare side; re-issue in the dashboard.
- Control plane cert expired → reach vps-net per
netbird-down.md, check the TLS container logs, confirm the ACME credentials, and re-run their stack project. - New public hostname → CNAME into the tunnel + tunnel ingress route; edge cert covers wildcard, no per-route work.
House rules: no per-service LetsEncrypt containers, no self-signed certs in production paths, the tunnel stays the single public ingress.