# Let's Encrypt Setup - DNS Record Required

**Date**: $(date)  
**Domain**: `rpc-core.d-bis.org`  
**Status**: ⚠️ **DNS RECORD REQUIRED**

---

## ⚠️ Current Status

The Let's Encrypt certificate acquisition **failed** because the DNS record for `rpc-core.d-bis.org` does not exist yet.

**Error**: `DNS problem: NXDOMAIN looking up A for rpc-core.d-bis.org`

---

## ✅ What Was Completed

1. ✅ Certbot installed
2. ✅ Nginx configuration updated (domain added to server_name)
3. ✅ Nginx reloaded
4. ✅ Auto-renewal timer enabled
5. ⏳ **Pending**: DNS record creation

---

## 🔧 Required: Create DNS Record

### Option 1: Direct A Record (If Server Has Public IP)

**In Cloudflare DNS Dashboard**:

1. **Navigate to DNS**:
   - Go to Cloudflare Dashboard
   - Select domain: `d-bis.org`
   - Click **DNS** → **Records**

2. **Create A Record**:
   ```
   Type: A
   Name: rpc-core
   IPv4 address: 192.168.11.250
   Proxy status: 🟠 Proxied (recommended) or ⚪ DNS only
   TTL: Auto
   ```

3. **Save Record**

**Note**: If using Cloudflare Proxy (🟠 Proxied), ensure:
- Port 80 is accessible through Cloudflare
- Cloudflare Tunnel is configured (if server is behind NAT)

### Option 2: Cloudflare Tunnel (CNAME) (Recommended for Internal Server)

**If using Cloudflare Tunnel (VMID 102)**:

1. **Get Tunnel ID**:
   ```bash
   # Check tunnel configuration
   pct exec 102 -- cloudflared tunnel list
   ```

2. **Create CNAME Record**:
   ```
   Type: CNAME
   Name: rpc-core
   Target: <tunnel-id>.cfargotunnel.com
   Proxy status: 🟠 Proxied (required for tunnel)
   TTL: Auto
   ```

3. **Configure Tunnel Route**:
   - In Cloudflare Zero Trust Dashboard
   - Go to **Networks** → **Tunnels**
   - Add route: `rpc-core.d-bis.org` → `192.168.11.250:443`

---

## 📋 After DNS Record is Created

### 1. Verify DNS Resolution

```bash
# Wait a few minutes for DNS propagation
dig rpc-core.d-bis.org
nslookup rpc-core.d-bis.org

# Should resolve to 192.168.11.250 or Cloudflare IPs (if proxied)
```

### 2. Obtain Let's Encrypt Certificate

```bash
# Run certbot again
pct exec 2500 -- certbot --nginx \
    --non-interactive \
    --agree-tos \
    --email admin@d-bis.org \
    -d rpc-core.d-bis.org \
    --redirect
```

### 3. Verify Certificate

```bash
# Check certificate
pct exec 2500 -- certbot certificates

# Test HTTPS
curl -X POST https://rpc-core.d-bis.org \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

---

## 🔄 Using Cloudflare API (Automated)

If you have Cloudflare API access, you can create the DNS record programmatically:

### 1. Get Cloudflare API Token

1. Go to Cloudflare Dashboard
2. **My Profile** → **API Tokens**
3. Create Token with:
   - **Zone**: DNS:Edit
   - **Zone Resources**: Include → Specific zone → `d-bis.org`

### 2. Create DNS Record via API

```bash
# Set variables
ZONE_ID="your-zone-id"
API_TOKEN="your-api-token"
DOMAIN="rpc-core.d-bis.org"
IP="192.168.11.250"

# Create A record
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data "{
    \"type\": \"A\",
    \"name\": \"rpc-core\",
    \"content\": \"$IP\",
    \"ttl\": 1,
    \"proxied\": true
  }"
```

---

## 📊 Current Configuration Status

### Nginx Configuration ✅
- Domain `rpc-core.d-bis.org` added to server_name
- Configuration valid and reloaded
- Ready for certificate

### Certbot ✅
- Installed and configured
- Auto-renewal timer enabled
- Ready to obtain certificate

### DNS Record ⏳
- **Status**: Not created yet
- **Required**: A record or CNAME pointing to server
- **Action**: Create DNS record in Cloudflare

---

## 🎯 Next Steps

1. **Create DNS Record**:
   - Option A: A record → `192.168.11.250` (if public IP)
   - Option B: CNAME → Cloudflare Tunnel (if using tunnel)

2. **Wait for DNS Propagation** (2-5 minutes)

3. **Obtain Certificate**:
   ```bash
   pct exec 2500 -- certbot --nginx \
       --non-interactive \
       --agree-tos \
       --email admin@d-bis.org \
       -d rpc-core.d-bis.org \
       --redirect
   ```

4. **Verify**:
   ```bash
   pct exec 2500 -- certbot certificates
   curl https://rpc-core.d-bis.org
   ```

---

## 📚 Related Documentation

- [Cloudflare DNS Configuration](./04-configuration/CLOUDFLARE_DNS_SPECIFIC_SERVICES.md)
- [Cloudflare Tunnel Setup](./04-configuration/CLOUDFLARE_TUNNEL_RPC_SETUP.md)
- [Let's Encrypt RPC 2500 Guide](./LETS_ENCRYPT_RPC_2500_GUIDE.md)

---

## ✅ Summary

**Status**: ⚠️ **WAITING FOR DNS RECORD**

- ✅ Nginx configured
- ✅ Certbot ready
- ⏳ **DNS record required**: Create A record or CNAME in Cloudflare

**Once DNS record is created**, run the certbot command again to obtain the certificate.

---

**Last Updated**: $(date)

