From 2d3e979d67559d4537727030025e97e75b81af2c Mon Sep 17 00:00:00 2001 From: dtoro Date: Thu, 4 Jun 2026 22:57:02 +0200 Subject: [PATCH] docs: note 2026-06-04 Caddy proxy fixes (auth.hubris.network, sso, forward-auth) --- infrastructure/dns.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/infrastructure/dns.md b/infrastructure/dns.md index 9cd9e89..c8f53f4 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -80,7 +80,17 @@ Either: ## Changelog -### 2026-06-03 — single *authoring* source: Technitium → NetBird managed zone sync +### 2026-06-04 — Caddy: proxy auth.hubris.network → VPS; fix stale /etc/hosts across fleet +Authentik had migrated to the VPS on 2026-05-31, but: +- Caddy's `auth.hubris.network` block still proxied to dead `192.168.8.6:9000` +- Caddy's `authentik` forward-auth snippet and `sso.hubris.network` block also referenced the stale IP +- Gitea's `/etc/hosts` had both the VPS IP and the old Caddy IP, causing Gitea to fail on OAuth2 token exchange with `404` then `issuer mismatch` + +**Fixed:** +- Caddy Caddyfile: `auth.hubris.network`, `authentik` snippet, and `sso.hubris.network` all proxy to VPS (`82.165.190.79:443`) with proper Host header stripping +- Gitea (LXC 104), Jellyfin (101), Paperless (103), Apps (105), Nextcloud (114), ElementSynapse (118), Mule-Images (120), ArrStack (122), Plato (126): /etc/hosts → `192.168.8.175` only (Caddy proxy) +- Caddy LXC (121) /etc/hosts: self-reference removed, points to VPS +- All stale `192.168.8.6` references eliminated from Caddyfile The "delete NetBird managed zone → forward everything to Technitium" plan was **abandoned** — NetBird's DNS defeats it: it **won't apply a nameserver group that contains the peer's own mesh IP** (the Mac's `100.122.234.17` → `Nameservers: 0/0 Available`), and nameserver-group forwarding to Technitium never actually took effect for mesh peers (the **managed zone was doing all the real work**; disabling it broke all mesh resolution). So the model is now: - **Technitium (`192.168.8.2`) is the single place you author DNS** (UI/API, MX/SPF/CAA, full zone).