Origin TLS with Certbot (Let's Encrypt)

Use this path when you do not use Cloudflare edge TLS, or when you need Full (strict) between Cloudflare and your VPS.

When to use

Scenario	TLS mode in admin settings
Cloudflare orange-cloud on app hostname	Cloudflare (default)
Direct VPS / grey-cloud only	Certbot
Cloudflare Full (strict)	Cloudflare + Certbot on origin

Platform mail hostname (MAIL_HOST) should stay grey-cloud (DNS only) so SMTP works. Only the app hostname typically needs HTTPS on the origin.

Install

sudo bash install/install.sh \
  --public-hostname app.example.com \
  --mail-hostname mail.example.com \
  --tls-hostname app.example.com

Or after install, set hostnames in Admin → Platform settings, choose Certbot, validate DNS, then Apply & restart.

Manual certbot:

sudo bash install/setup-certbot.sh app.example.com
sudo bash install/apply-platform.sh

Nginx

Origin TLS uses install/nginx/coldfeet-tls.conf (listen 443, proxy to web/api). Certbot manages certificates under /etc/letsencrypt/live/.

Renewal

Certbot installs a systemd timer. After renewal, nginx is reloaded by /etc/letsencrypt/renewal-hooks/deploy/coldfeet-reload-nginx.sh (installed by install/setup-certbot.sh).

Verify renewal anytime:

sudo certbot renew --dry-run
sudo bash install/setup-certbot.sh --verify-acme your.domain.com

Check expiry in Admin → Platform settings (reads cert file metadata when available).

Troubleshooting

HTTP-01 fails — Run preflight: sudo bash install/setup-certbot.sh --verify-acme your.domain.com. Ensure DNS A record points to this server and port 80 serves /.well-known/acme-challenge/ (not redirected to HTTPS).
Renewal fails — TLS nginx must keep ACME on port 80 (see coldfeet-tls.conf). Test: sudo certbot renew --dry-run.
SMTP broken — Do not orange-cloud the mail hostname; MX must resolve to your server IP.
Apply did not restart — Set PLATFORM_APPLY_EXEC=true on the API container or run install/apply-platform.sh on the host.