From b7cfc350b3399c18da4ef05a71ebc9f942867e81 Mon Sep 17 00:00:00 2001 From: dtoro Date: Wed, 24 Jun 2026 17:38:57 +0200 Subject: [PATCH] trmnl (128): public path verified live; root-cause the mesh outage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause of the provision-time 504s: netbird home-lab-network (192.168.8.0/24) had no active routing peer — mac-mini routing peer's netbird daemon was down, so all home-backed public services (artifacto/blog/trmnl) 504'd at the VPS edge. netbird up on mac-mini restored it; verified trmnl public 200/401, artifacto 200. Co-Authored-By: Claude Opus 4.8 --- containers/128-trmnl.md | 3 +++ infrastructure/ingress.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/containers/128-trmnl.md b/containers/128-trmnl.md index cfcfc4f..36fbf36 100644 --- a/containers/128-trmnl.md +++ b/containers/128-trmnl.md @@ -38,5 +38,8 @@ Not yet SOPS-enrolled. The poll token is set directly in `/etc/trmnl-plugins/env - [Plan: 2026-06-24 TRMNL plugins LXC](../plans/2026-06-24-trmnl-plugins-lxc.md) ## Changelog +### 2026-06-24 — public path live +Verified end-to-end from the internet: `https://trmnl.hubris.network/munich-home/dashboard` → 200 with token, 401 without; `/health` 200. The provision-time outage was the netbird `home-lab-network` (192.168.8.0/24) route having no active routing peer — the **mac-mini routing peer's netbird daemon was down** (artifacto/blog were 504 too). Bringing netbird up on mac-mini restored the route; the edge recovered with no config change. See [ingress](../infrastructure/ingress.md) / [mesh](../infrastructure/mesh.md). + ### 2026-06-24 — provisioned LXC 128 created (Debian 13, unprivileged, `192.168.8.211`). Deployed `trmnl-plugins.service` on :9851 from `dtoro/terminalito`. Caddy block added (`dtoro/caddy-conf`) + LE cert via IONOS DNS-01; verified `/health` 200 and `/munich-home/dashboard` (live weather) through Caddy. Cert mirrored to VPS (`trmnl.fullchain.crt`/`trmnl.privkey.key`) + traefik router `trmnl-public` → `192.168.8.211:9851` added to `/opt/traefik-dynamic.yaml`. **Public path pending**: VPS↔home netbird route was down at provision time (`No networks available`, 3/6 peers — artifacto/blog also 504); resolves when the mesh route recovers. **LAN pending**: Technitium A record not yet added. Not SOPS-enrolled; Google/MVG creds pending. diff --git a/infrastructure/ingress.md b/infrastructure/ingress.md index 59d34e3..f717575 100644 --- a/infrastructure/ingress.md +++ b/infrastructure/ingress.md @@ -87,7 +87,7 @@ No cert-mirror entry and no `hubris-public-cert-sync.sh` mapping is needed for ` ## Changelog ### 2026-06-24 — `trmnl.hubris.network` exposed -TRMNL plugins middleware on [trmnl (128)](../containers/128-trmnl.md). File-provider router `trmnl-public` → `192.168.8.211:9851`, `trmnl-ratelimit` (20 rps / 40 burst), cert mirrored as `trmnl.fullchain.crt`/`trmnl.privkey.key`. Note: provisioned while the VPS↔home netbird route was down (`No networks available`, 3/6 peers — artifacto/blog 504 too); serves once the mesh route recovers. +TRMNL plugins middleware on [trmnl (128)](../containers/128-trmnl.md). File-provider router `trmnl-public` → `192.168.8.211:9851`, `trmnl-ratelimit` (20 rps / 40 burst), cert mirrored as `trmnl.fullchain.crt`/`trmnl.privkey.key`. Verified live from the internet (200 with token / 401 without). It was provisioned during a mesh outage — the `home-lab-network` (192.168.8.0/24) route had no active routing peer because the **mac-mini routing peer's netbird was down** (all home-backed public services 504'd). Bringing netbird up on mac-mini restored the route; no traefik change was needed. ### 2026-05-31 — `auth.hubris.network` now served locally on the VPS Authentik migrated onto the VPS ([investigation](../investigations/2026-05-31-authentik-vps-migration.md)). Unlike the home-backed services above, `auth` is a local container routed via traefik Docker-provider labels with traefik-managed Let's Encrypt — no cert-mirror, no `traefik-dynamic.yaml` router. Admin UI gated by an ipAllowList middleware. Traefik gained a second Docker network (`auth`, `172.30.1.0/24`) to reach it while keeping its DB/Redis isolated from the netbird stack.