-
Turns out this is because of
Strict-Transport-Security: max-age=63072000; includeSubDomains
on the (hosted; outside of my control) Mastodon instance on the root domain. I forgot that HSTS hadincludeSubDomains
. Thanks to you who pointed at HSTS as a likely culprit. -
…so I guess this week's evening project will be "build a docker image to do nginx reverse proxy + certbot that will run on the Synology DSM to delegate HTTPS on LAN hosts"… (nothing is ever easy)