Served by nginx on op1. The TLS certificate was issued by acme.sh via the DNS-01 challenge (DuckDNS) — no inbound port 80 was used to obtain it, and nginx was pointed at the cert manually (unlike certbot, which edits nginx for you).