From a45e4f6f299beb8fe6b5001e257b170704c16eb8 Mon Sep 17 00:00:00 2001 From: dtoro Date: Mon, 29 Jun 2026 22:13:11 +0200 Subject: [PATCH] docs(teddycloud): correct IP, port, disable boxCertAuth, ESP32 onboarding Real IP is 192.168.8.243 (not .214). Web UI is on port 8443 HTTPS, not 8080. Caddy backend uses tls_insecure_skip_verify. boxCertAuth disabled so ESP32 Toniebox connects without client cert extraction. Added SD card onboarding steps for Leon's ESP32 box. Co-Authored-By: Claude Sonnet 4.6 --- containers/131-teddycloud.md | 36 ++++++++++++++++++++++-------------- containers/index.md | 2 +- infrastructure/dns.md | 4 ++-- 3 files changed, 25 insertions(+), 17 deletions(-) diff --git a/containers/131-teddycloud.md b/containers/131-teddycloud.md index 09c7b3e..32a67c6 100644 --- a/containers/131-teddycloud.md +++ b/containers/131-teddycloud.md @@ -5,7 +5,7 @@ Open-source replacement server for Toniebox smart audio devices (Tonieboxes). Se ## At a glance - **Hostname:** `teddycloud` -- **IP:** `192.168.8.214` (DHCP reservation) +- **IP:** `192.168.8.243` (DHCP reservation; MAC `bc:24:11:11:7a:df`) - **Privilege:** privileged - **Resources:** 1 core / 1 GiB RAM / 16 GiB rootfs (Debian 12) - **Mounts:** `/mnt/library` (`mp0`) — TeddyCloud content at `/mnt/library/cloud/leon` @@ -21,8 +21,7 @@ Replaces the Boxine cloud (`prod.de.bb-online.com`) as the backend for Leon's To |---------|--------|-------| | TeddyCloud device API | `0.0.0.0:443` | HTTPS, TeddyCloud self-signed CA, Toniebox connects here | | TeddyCloud HTTP | `0.0.0.0:80` | Redirects to 443 | -| TeddyCloud web UI | `0.0.0.0:8080` | HTTP management UI — fronted by Caddy at `teddy.hubris.network` | -| TeddyCloud web UI (HTTPS) | `0.0.0.0:8443` | HTTPS management UI (direct, not Caddy-fronted) | +| TeddyCloud web UI | `0.0.0.0:8443` | HTTPS management UI — fronted by Caddy at `teddy.hubris.network` (backend uses `tls_insecure_skip_verify` for self-signed cert on LAN hop) | ## Docker Compose @@ -35,7 +34,6 @@ services: ports: - "80:80" - "443:443" - - "8080:8080" - "8443:8443" volumes: - certs:/teddycloud/certs @@ -64,12 +62,12 @@ Two separate traffic paths — different IPs, no port 443 conflict: **Management UI (browser):** ``` -teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.214:8080 +teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.243:8443 ``` **Toniebox device traffic:** ``` -prod.de.bb-online.com → Technitium override → 192.168.8.214:443 (TeddyCloud direct) +prod.de.bb-online.com → Technitium override → 192.168.8.243:443 (TeddyCloud direct) ``` Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCloud terminates TLS for device traffic with its own self-signed CA — the Toniebox must have this CA installed. @@ -79,21 +77,31 @@ Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCl | Record | Type | Value | Purpose | |--------|------|-------|---------| | `teddy.hubris.network` | A | `192.168.8.175` | Management UI → Caddy (standard pattern) | -| `prod.de.bb-online.com` | A | `192.168.8.214` | Toniebox device traffic → TeddyCloud direct | +| `prod.de.bb-online.com` | A | `192.168.8.243` | Toniebox device traffic → TeddyCloud direct | The `prod.de.bb-online.com` override is Technitium-only — it intercepts Toniebox DNS locally without touching public DNS. The `dns-sync.py` cron on LXC 107 skips non-`hubris.network` records, so it stays local. -## Toniebox onboarding +## Config notes -To point a Toniebox at TeddyCloud: +- `core.boxCertAuth=false` — client cert validation disabled. The box connects without presenting its unique client cert. Set in `/var/lib/docker/volumes/teddycloud_config/_data/config.ini` (TeddyCloud hot-reloads on change). +- If you ever want per-box auth, flip to `true` and supply `certs/client/ca.der`, `client.der`, `private.der` extracted from the box flash. -1. Download the TeddyCloud CA cert from the web UI: **Settings → TeddyCloud CA**. -2. Flash it to the Toniebox via SD card or firmware patch (procedure varies by hardware generation — see [upstream wiki](https://github.com/toniebox-reverse-engineering/teddycloud/wiki)). -3. The box resolves `prod.de.bb-online.com` to Technitium's override (`192.168.8.214`) and connects on port 443 using TeddyCloud's CA. +## Toniebox onboarding — ESP32 SD card method + +Leon's box is ESP32 generation. No hardware mod required. + +1. Download the TeddyCloud CA cert from the web UI: **Security → CA Certificate → Download CA** (`ca.der`). +2. Power off the Toniebox, remove the SD card. +3. On the SD card, create folder `cert/` at the root. +4. Copy the downloaded `ca.der` into `cert/ca.der` on the SD card. +5. Reinsert SD card, power on the box. +6. The box patches itself to trust TeddyCloud's CA, then resolves `prod.de.bb-online.com` via Technitium's override (`192.168.8.243`) and connects on port 443. + +Reference: [upstream wiki — ESP32 SD card method](https://github.com/toniebox-reverse-engineering/teddycloud/wiki). ## Related -- [Caddy (121)](121-caddy.md) — LAN reverse proxy (`teddy.hubris.network → 192.168.8.214:8080`) +- [Caddy (121)](121-caddy.md) — LAN reverse proxy (`teddy.hubris.network → 192.168.8.243:8443`) - [DNS (107)](../infrastructure/dns.md) — Technitium A records for `teddy.hubris.network` and `prod.de.bb-online.com` - [Media permissions](../infrastructure/media-permissions.md) — NAS `/mnt/library` mount pattern @@ -101,4 +109,4 @@ To point a Toniebox at TeddyCloud: ### 2026-06-29 — provisioned -LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at `/opt/teddycloud/`. Content bind-mounted from `/mnt/library/cloud/leon`. Caddy block added at `teddy.hubris.network → :8080`. Technitium A records: `teddy.hubris.network → 192.168.8.175` (Caddy), `prod.de.bb-online.com → 192.168.8.214` (device traffic direct). +LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at `/opt/teddycloud/`. Content bind-mounted from `/mnt/library/cloud/leon`. Caddy block added at `teddy.hubris.network → :8443`. Technitium A records: `teddy.hubris.network → 192.168.8.175` (Caddy), `prod.de.bb-online.com → 192.168.8.243` (device traffic direct). diff --git a/containers/index.md b/containers/index.md index 399aba2..2b10d39 100644 --- a/containers/index.md +++ b/containers/index.md @@ -18,7 +18,7 @@ All containers live on [`hubris`](../hosts/hubris.md). Each row links to the per | 128 | [trmnl](128-trmnl.md) | 192.168.8.211 | unpriv | 1 | 768 MiB | 8 GiB | — | `trmnl.hubris.network` | running | | 129 | [house](129-house.md) | 192.168.8.212 | unpriv | 1 | 1344 MiB | 8 GiB | — | `house.hubris.network` | running | | 130 | [grimmory](130-grimmory.md) | 192.168.8.213 | priv | 1 | 2 GiB | 16 GiB | `/mnt/library` | `books.hubris.network` | running | -| 131 | [teddycloud](131-teddycloud.md) | 192.168.8.214 | priv | 1 | 1 GiB | 16 GiB | `/mnt/library` | `teddy.hubris.network` (LAN only) | running | +| 131 | [teddycloud](131-teddycloud.md) | 192.168.8.243 | priv | 1 | 1 GiB | 16 GiB | `/mnt/library` | `teddy.hubris.network` (LAN only) | running | ## Recently destroyed (kept for archaeology) diff --git a/infrastructure/dns.md b/infrastructure/dns.md index 71c15ae..5732508 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -40,7 +40,7 @@ address=/nfs-export.hubris.network/192.168.8.200 **Non-`hubris.network` override (Toniebox device traffic):** ``` -address=/prod.de.bb-online.com/192.168.8.214 # → TeddyCloud (131) direct on :443 +address=/prod.de.bb-online.com/192.168.8.243 # → TeddyCloud (131) direct on :443 ``` This intercepts Toniebox DNS locally without touching public DNS. The `dns-sync.py` cron on LXC 107 skips non-`hubris.network` records — this entry is Technitium-only. @@ -85,7 +85,7 @@ Either: ## Changelog ### 2026-06-29 — `teddy.hubris.network` added; `prod.de.bb-online.com` override added -TeddyCloud (LXC 131) provisioned. `teddy.hubris.network → 192.168.8.175` (Caddy → TeddyCloud web UI at :8080). Non-hubris override `prod.de.bb-online.com → 192.168.8.214` routes Toniebox device HTTPS traffic directly to TeddyCloud port 443 — this bypasses Caddy and is Technitium-only (dns-sync cron does not replicate non-hubris.network records to the NetBird managed zone). +TeddyCloud (LXC 131) provisioned. `teddy.hubris.network → 192.168.8.175` (Caddy → TeddyCloud web UI at :8443). Non-hubris override `prod.de.bb-online.com → 192.168.8.243` routes Toniebox device HTTPS traffic directly to TeddyCloud port 443 — this bypasses Caddy and is Technitium-only (dns-sync cron does not replicate non-hubris.network records to the NetBird managed zone). ### 2026-06-28 — `plato.hubris.network` removed Plato (LXC 126) decommissioned. Technitium entry deleted; dns-sync cron reaped the NetBird managed zone record.