EC2 i-00fbb7584cd890340, eu-central-1, 52.59.238.110. Listed as permanent in the hosts registry.
John (2026-09-17): "gravlax is a different kind of host - it has the web server function and so on; newly deployed hosts are for more transient tasks. Kelp started being a transient host but is permanent and should take over from gravlax." So the inventory's eu-central-1 group mixes two quite different things: kelp, which is permanent and is to inherit gravlax's service role, and the fungi-named hosts (morel, enoki, maitake, chanterelle, …) which are ephemeral delayrepay browser hosts, launched and terminated per claim. Do not treat kelp as disposable because of the company it keeps in hosts.ini.
gravlax currently carries the web-server role: the three 443 vhosts (www, cv, webdav), WebDAV storage including the kathy migration archive and the /mail Maildir alias that popit3/Envoy mail delivery depends on, Let's Encrypt certificates, and the notes-server infrastructure. See hosts/gravlax.
setup_server.yml obtains certificates with certbot certonly --webroot, i.e. the ACME HTTP-01 challenge, which requires the domain to already resolve to the host being provisioned. Run the playbook against kelp while DNS still points at gravlax and the challenge is answered by gravlax, so certbot fails and the play stops before the vhosts are enabled. The repo has no DNS-01 support at all — no --preferred-challenges anywhere, and the zoneedit/ directory is empty — so this cannot currently be worked around by changing challenge type.
/etc/letsencrypt from gravlax to kelp at cutover. Certificates are portable; no challenge needed, no downtime window./mnt, bind-mounted to /var/www/webdav/kathy. kelp needs equivalent storage provisioned before any data moves, or it will fill root the same way gravlax did.sites-enabled, not symlinks from sites-available, and they diverge from what ansible would deploy. Anyone diffing gravlax to work out what kelp needs must read sites-enabled, not sites-available, or they will copy the wrong (pre-multi-SAN) certificate configuration. The repo itself was corrected on 2026-09-17 and is now the reliable source.