Editing Wiki.tetrain.com Runbook (section)

=== 4.4 Firewall + TLS ===

<pre>
<nowiki>
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

certbot --apache -d wiki-new.tetrain.com --non-interactive --agree-tos \
  -m root@wiki-new.tetrain.com --redirect
</nowiki>
</pre>

Confirmed live via <code><nowiki>/etc/letsencrypt/renewal/wiki-new.tetrain.com.conf</nowiki></code>: <code><nowiki>authenticator = apache</nowiki></code>, <code><nowiki>installer = apache</nowiki></code>, ECDSA key type, auto-renewal configured. This is the exact same command pattern used again in Phase 8 to expand the cert — see there for the real, later-run command including <code><nowiki>--expand</nowiki></code>.

'''Verify''': <code><nowiki>curl -I https://wiki-new.tetrain.com/</nowiki></code> returns a real TLS handshake (this session's original note: "confirmed serving HTTPS correctly, 403 expected — empty docroot, MediaWiki not deployed yet" at this point in the sequence).

----