| Where | Cert | Renewal |
|---|---|---|
NPM (*.codycodez.com hosts) |
Let's Encrypt via NPM | auto (NPM), certs in /opt/nginx-proxy-manager/letsencrypt |
| Proxmox web UIs :8006 | self-signed | manual accept |
| Frigate :8971 | self-signed | built-in |
| Authentik :9443 | self-signed default | — |
| Tailscale HTTPS | not used yet | tailscale cert available per node |
Future: Authentik + NPM already terminate TLS at the edge; internal hops stay HTTP on the LAN. If internal TLS matters later, tailscale cert or a private CA (step-ca) are the options.