pipistrelloandClaude Opus 5
445bb83072
Both pre-cutover prerequisites are satisfied: - Port 80 NAT moved back to the docker host (192.168.0.9); verified externally that :80 is answered there. This is what lets the exchange-acme router forward /.well-known/acme-challenge/ to Exchange and replace the manual NAT repoint that every past win-acme renewal has needed. - traefik.shcnw.ru A 217.15.22.194 created, so the dashboard router is uncommented. The router was shipped disabled because ACME validates from the internet even for a LAN-only router — ipAllowList gates access, not issuance. That rule is now stated explicitly in the README rather than left as a one-off note, since it applies to every LAN-only host in this stack (start, portainer, cockpit). The earlier pre-flight already parsed this exact router (it got as far as attempting issuance for traefik.shcnw.ru and failing on NXDOMAIN), so the uncomment is not introducing anything unvalidated. Host restage of dynamic/services.yml is still PENDING — the 43009 tunnel went down before it could be copied. The host currently holds the previous revision, in which the dashboard router is absent. Everything else is identical, so a deploy before the restage would come up correctly minus the dashboard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>