docs(hk2): document Traefik dashboard auth and password rotation

hosts/hk2.chans.xyz.md

@@ -56,7 +56,8 @@ See full shape in [docs/pdns-upstream.md](../docs/pdns-upstream.md). Live secret
 | `poweradmin` | poweradmin | Up (healthy) | `poweradmin/poweradmin:stable` |
 | `pdns_pgweb` | pgweb | Up | `sosedoff/pgweb:0.16.2` |
 | `pdns-backup` | backup | Up | `postgres:16` (scheduler) |
-| `powerdns-admin` | *(orphan)* | Exited | legacy PDA UI — not in active compose |
+
+> Legacy PDA UI container `powerdns-admin` (orphan, Exited) was removed 2026-08-12 (W1N-59).
 
 ### Network model
 
@@ -100,9 +101,60 @@ See full shape in [docs/pdns-upstream.md](../docs/pdns-upstream.md). Live secret
 
 **Quirk:** `backend` is internal — backup must not use Alpine + runtime `apk`/`crond`. Uses `postgres:16` + `backup-scheduler.sh` (fixed 2026-08-01).
 
-## Other software on this host (stubs)
+## RustDesk Server
 
-`/opt/traefik`, `/opt/adguard`, `/opt/remark42`, `/opt/rustdesk`, `/opt/nginx-manager`, …
+**Status: operational** (hbbs + hbbr Up; image pinned `1.1.14`; relay address fixed 2026-08-12, W1N-59).
+
+| Item | Value |
+|------|--------|
+| Install path | `/opt/rustdesk` |
+| Compose | `/opt/rustdesk/compose.yml` |
+| Containers | `hbbs` (rendezvous), `hbbr` (relay) |
+| Image | `rustdesk/rustdesk-server:1.1.14` (pinned) |
+| Relay (hbbr) | `hk2.chans.xyz:21117` — advertised to clients via `hbbs -r` |
+| Rendezvous (hbbs) | `21115/tcp` (NAT test), `21116/tcp+udp`, `21118/tcp` (ws) |
+| Relay (hbbr) | `21117/tcp`, `21119/tcp` (ws) |
+| Public IP | `154.36.174.161` |
+| Health | [runbooks/rustdesk-health.md](../runbooks/rustdesk-health.md) |
+
+**Note:** the relay hostname in `hbbs -r` must resolve to this host's public IP
+(`154.36.174.161`). `hk2.chans.xyz` resolves correctly; the previously used
+`hk2.wsvc.info` had **no DNS record** and broke relay connectivity for clients
+(fixed 2026-08-12, W1N-59).
+
+## Other software on this host (confirmed 2026-08-12)
+
+Verified live via `docker ps` / port scan. Each runs as a separate compose
+project under `/opt/<name>` and is fronted by Traefik where noted.
+
+| Service | Path | Container(s) | Image | Ports / notes |
+|---------|------|--------------|-------|---------------|
+| Traefik | `/opt/traefik` | `traefik` | `traefik:v3.6.2` | `80`, `443` (TLS entry), `8080` (dashboard) |
+| AdGuard Home | `/opt/adguard` | `adguardhome` | `adguard/adguardhome:latest` | DoH `5443`, DoT `853` (bridge; no LAN `:53`) |
+| Remark42 | `/opt/remark42` | `remark42` | `ghcr.io/umputun/remark42:latest` | no host ports; via Traefik (in-container `8080`) |
+
+### Traefik dashboard auth
+
+| Item | Value |
+|------|-------|
+| Dashboard URL | `https://npm.chans.xyz` (Traefik `api@internal` router), also host `:8080` |
+| Auth | HTTP Basic via Traefik `basicauth` middleware (label `dashboard-auth`) |
+| User | `windy` — stored as a **bcrypt** hash (plaintext never stored) |
+| Hash generator | `/opt/traefik/generate-dashboard-auth.sh` (bcrypt; auto `$`→`$$` compose escaping) |
+| Config | `/opt/traefik/compose.yml` (label `traefik.http.middlewares.dashboard-auth.basicauth.users`) |
+
+**Password rotated 2026-08-12** from apr1/MD5 to bcrypt via the generator script; the
+plaintext lives only in the operator's password manager, never in this repo.
+To rotate again: `cd /opt/traefik && ./generate-dashboard-auth.sh windy`, paste the
+printed label into `compose.yml`, then `docker compose up -d --force-recreate traefik`.
+
+`/opt/nginx-manager` was a leftover (compose + `data/` + `letsencrypt/`, no running
+container) and was **removed 2026-08-12**; pre-deletion backup:
+`/opt/backups/nginx-manager-20260812.tar.gz`.
+
+Health coverage: these auxiliary services are checked by the `hk2aux`
+health-check profile (`ansible/roles/healthcheck`). Run:
+`cd ansible && ansible-playbook playbooks/health-report.yml --limit powerdns`.
 
 ## Ops / runbooks