Operations

Active architecture

Public browser
    │ HTTPS, Let's Encrypt
    ▼
rpctm (154.65.108.7)
    │ Nginx; strict origin certificate verification
    │ WireGuard 10.99.0.1 → 10.99.0.157
    ▼
flexible-page-builder.huis
    │ HTTPS, internal CA; systemd, unprivileged Node.js
    ▼
VitePress static build on TCP 443

The public site is intentionally unauthenticated and carries noindex, nofollow, noarchive in both HTML and HTTP headers. Firewall changes and monitoring remain deferred; crawler policy is not access control.

Service records

Item	Value
Application service	flexible-page-builder-docs.service
Certificate timer	flexible-page-builder-cert-renew.timer
Repository	/opt/flexible-page-builder
Application	/opt/flexible-page-builder/docs-server
VitePress source	/opt/flexible-page-builder/docs-server/site
Certificate	/etc/flexible-page-builder/tls/fullchain.pem
Private key	/etc/flexible-page-builder/tls/privkey.pem
Internal URL	https://flexible-page-builder.huis/
Public URL	https://flexible-page-builder.reverse-proxy.co.za/
Origin WireGuard	wg-rpctm, 10.99.0.157/32
Proxy WireGuard	wg0, 10.99.0.1/24
Public proxy	rpctm, 154.65.108.7
Initial origin certificate expiry	16 July 2027 UTC
Initial public certificate expiry	14 October 2026 UTC
Origin renewal	30-day window; checked twice daily
Public renewal	Certbot; checked twice daily

Health checks

systemctl is-active flexible-page-builder-docs.service
systemctl list-timers --all flexible-page-builder-cert-renew.timer
curl --fail --cacert /root/.step/certs/root_ca.crt \
  https://flexible-page-builder.huis/healthz
curl --fail \
  https://flexible-page-builder.reverse-proxy.co.za/healthz

Expected health response: ok.

Routine deployment

cd /opt/flexible-page-builder
git pull --ff-only
cd docs-server
npm ci
npm run check
npm audit --omit=dev
npm run qa
sudo systemctl restart flexible-page-builder-docs.service

Record the deployed commit with git rev-parse HEAD and verify both health endpoints.

Service units, origin WireGuard units, and the proxy vhost are versioned under deploy/. Validate service units with systemd-analyze verify, reload networkd only after reviewing the route, and run nginx -t before every proxy reload.

Manual operational checks

Until monitoring exists, periodically check:

openssl x509 -in /etc/flexible-page-builder/tls/fullchain.pem -noout -enddate
journalctl -u flexible-page-builder-cert-renew.service --since '30 days ago' --no-pager
journalctl -u flexible-page-builder-docs.service --since today --no-pager
ssh rpctm 'sudo wg show wg0; sudo certbot certificates; sudo nginx -t'

An on-demand renewal check is expected to report exec-condition while the certificate has more than 30 days remaining; that is a successful skip, not a renewal failure.

Deferred controls

• Origin firewall policy.
• Certificate-expiry and renewal-failure alerts.
• Authentication if the approved public, unauthenticated policy changes.