Backlog: dev-lisilou.jerodrigged.com blocked on missing NPM proxy host (B5)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/BACKLOG-2026-07-16.md

@@ -43,6 +43,28 @@ stopped reaching GitHub. I've synced GitHub main and both pipelines are green, b
 - `homelab/docs/infrastructure.md` is stale (lists CT114 as Keycloak; CT111 notes
   don't mention the GitHub runner deploy chain)
 
+### B5. dev-lisilou.jerodrigged.com has no NPM proxy host
+The Cloudflare tunnel delivers the hostname to NPM (CT102), but NPM has no proxy
+host for it, so it falls through to the "Jerod Rigged" default landing page.
+Verified: `curl -H "Host: dev-lisilou.jerodrigged.com" http://192.168.1.185/`
+→ landing page, while the same probe with `Host: lisilou.jerodrigged.com` →
+`healthy`. I could not fix this without the NPM admin login (192.168.1.185:81 —
+presumably in Vaultwarden; factory default is disabled, and neither SSH nor the
+ansible key works from this machine).
+
+**Fix (2 min in NPM UI):** Hosts → Proxy Hosts → Add:
+- Domain: `dev-lisilou.jerodrigged.com`
+- Scheme `http`, Forward Host `192.168.1.192`, Port `8080`
+- Websockets ON, Block Common Exploits ON; SSL tab: same as the
+  `lisilou.jerodrigged.com` host
+Also confirm the hostname exists as a public hostname/CNAME in the CF tunnel
+config (it already resolves and reaches NPM, so likely fine).
+
+**So the agent can do this next time:** put the NPM admin credential in a place
+Claude can reach (e.g. `NPM_ADMIN_IDENTITY`/`NPM_ADMIN_SECRET` env vars, or an
+API-only NPM user), or install/authorize the `~/.ssh/ansible_ed25519` key on
+this machine.
+
 ## Security
 
 ### S1. Signed-contract download is unauthenticated and enumerable