From 65f6c14487c083b1cffaac9c6081ad8194cdf281 Mon Sep 17 00:00:00 2001 From: Claudio Date: Sun, 26 Apr 2026 08:17:52 +0200 Subject: [PATCH] fix(nextcloud): pin cloud.hubris.network to LAN caddy IP in compose Without this, the docker default resolver forwards the lookup to the host gateway, which returns the public IONOS VPS IP. cloud.hubris is not in the VPS traefik exposure list, so TLS handshakes during WebDAV calls die with httpx.ConnectError: SSL UNEXPECTED_EOF. extra_hosts pins it to caddy on 192.168.8.175, which holds the cloud.hubris.network cert and proxies to the Nextcloud LXC. Applied to every service for symmetry; only backend currently makes the WebDAV calls. Co-Authored-By: Claude Opus 4.7 (1M context) --- docker-compose.yml | 56 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 1ba3fa0..782fec9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,6 +12,14 @@ services: - backend networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped backend: @@ -98,6 +106,14 @@ services: condition: service_healthy networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped # ── Celery workers ───────────────────────────────────────────────────── @@ -163,6 +179,14 @@ services: start_period: 120s networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped # Dedicated watcher worker — runs the long-lived watch_folders task @@ -197,6 +221,14 @@ services: condition: service_healthy networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped worker-vision: @@ -263,6 +295,14 @@ services: condition: service_healthy networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped db: @@ -276,6 +316,14 @@ services: - pg_data:/var/lib/postgresql/data networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped healthcheck: test: ["CMD-SHELL", "pg_isready -U mulita -d mulita"] @@ -294,6 +342,14 @@ services: - redis_data:/data networks: - mulita-network + # Pin cloud.hubris.network to the LAN caddy IP. Without this, the + # docker DNS forwards the lookup to the host's resolver, which + # returns the public IONOS VPS IP — but cloud isn't in the VPS + # traefik exposure list, so TLS handshakes against it die with + # "unexpected eof while reading". Caddy on 192.168.8.175 holds the + # cloud.hubris.network cert and proxies to the Nextcloud LXC. + extra_hosts: + - "cloud.hubris.network:192.168.8.175" restart: unless-stopped command: redis-server --appendonly yes healthcheck: