dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
493ae50f376d74c19125b4fdbac5b936c49d6112
oikos/containers/121-caddy.md
dtoro fd35b48c8d Phase 1-4: full doc reorg 
Phase 1 — fix stale state after strong migration (Phase 1+2, 2026-07-05)
  - README: corrected IPs (jellyfin 206→246, arriman 132→245, etc.),
    added missing containers (128 trmnl, 129 house, 133 seanime, 134 romm,
    124 authentik), updated last-refreshed date, added strong host context
  - containers/101-jellyfin.md: IP 206→246, host hubris→strong, mount
    /mnt/library→/mnt/media_local, GPU 760M→680M+RX7600, privilege→priv
  - containers/118-elementsynapse.md: IP 239→242, added Host: strong
  - containers/122-arriman.md: IP 132→245, mount→/mnt/media_local, added Host
  - containers/129-house.md: IP 212→244, added Host: strong
  - containers/130-grimmory.md: IP 213→247, mount→/mnt/media_local, added Host
  - containers/121-caddy.md: fixed site list (books→grimmory, removed auth→VPS,
    added house, roms, teddy, trmnl)
  - hosts/strong.md: updated At-a-glance to reflect 7 LXCs hosted
  - containers/123-claudio-bot.md, 127-mule-photos-new.md: archived to
    containers/archive/ (were destroyed LXCs with living pages)
  - inventory.yaml: verified correct — no changes needed

Phase 2 — structural cleanup
  - infrastructure/index.md: one-page overview of all cross-cutting systems
  - runbooks/: moved runbook-budget-from-csv.md and runbook-dpkg-interrupted.md
    from operations/ with YAML frontmatter added
  - plans/done/: moved 4 completed plans out of active view; updated index
  - vms/index.md: added VM index page

Phase 3 — navigation & discoverability
  - GLOSSARY.md: term definitions (Authentik, Caddy, LXC, VAAPI, etc.)
  - README: added table of contents, links to glossary + infrastructure index
  - investigations/: archived 2 resolved cases (crash-loop, authentik-migration)
    to investigations/archive/; updated index with active vs archived sections

Phase 4 — ongoing discipline
  - CONTRIBUTING.md: documented same-session update rule with explicit checklist
  - README: replaced full LXC table with summary + link to containers/index.md
    (single source of truth; de-duplication)
2026-07-06 00:46:27 +02:00

7.2 KiB
Raw Blame History

121 — caddy

The reverse proxy. Terminates TLS for every *.hubris.network hostname on the LAN/mesh and forwards to the right backend.

At a glance

  • Hostname: caddy
  • IP: 192.168.8.175
  • Privilege: unprivileged
  • Resources: 1 core / 512 MiB RAM / 6 GiB rootfs
  • Mounts: none from /mnt/library
  • Config: /etc/caddy/Caddyfile is a git checkout of dtoro/caddy-conf
  • Cert source: Let's Encrypt DNS-01 via IONOS API (IONOS_AUTH_API_TOKEN).

Sites currently served (live as of 2026-07-06)

Reminder: Caddy alone isn't enough to make a new subdomain reachable on the LAN. Each one needs an entry in DNS split-horizon too.

Snippet: (authentik) forward-auth

A snippet at the top of the Caddyfile (used as import authentik in any site block) wires forward-auth to the embedded Authentik outpost. It points at http://192.168.8.180:9000 directly (NOT https://auth.hubris.network) to avoid Caddy-to-self round-tripping that strips X-Forwarded-Host. The forward-auth block must explicitly set header_up X-Forwarded-Host {host}. See Authentik.

For apps with mobile clients, /api/* (or equivalent) bypasses forward-auth — see the per-app gotchas in Authentik.

Caddy environment

Untracked secrets in /etc/caddy/caddy.env:

  • IONOS_AUTH_API_TOKEN — DNS-01 ACME
  • ARTIFACTO_GATEWAY_SECRET — must match SSO_GATEWAY_SECRET on apps (105). Rotate together.

Auto-deploy

Push to dtoro/caddy-conf master → gitea webhook → http://192.168.8.175:9797/deploy → caddy-deploy-webhook.service validates HMAC against /etc/caddy-deploy/secret → runs /etc/caddy/scripts/deploy.sh:

  1. git pull
  2. caddy validate
  3. systemctl reload caddy

Gitea webhook id 2 on dtoro/caddy-conf. Receiver, deploy script, install scripts, systemd unit all live in the repo under scripts/. The unit has ReadWritePaths=/etc/caddy — load-bearing (ProtectSystem=full would otherwise block git pull). Git credentials for the root-run service are at /etc/caddy-deploy/git-credentials (mode 600).

Systemd unit changes inside the repo do NOT auto-reinstall — you have to re-run scripts/webhook/install.sh manually after editing the unit.

Related

Changelog

2026-06-13 — sab.hubris.network gated with Authentik forward-auth; port fixed :8081→:8082

sab.hubris.network now uses import authentik inside a handle block. SABnzbd own auth disabled, local_ranges set for transparent proxy. Port bumped from :8081 to :8082 (fix from 2026-06-04) now documented.

2026-06-06 — Caddyfile truncated to 43 lines; restored from origin/master + safeguards added

Symptom: All *.hubris.network hosts except photos and auth (VPS-hosted) returned tlsv1 alert internal error or timeout. Only 3 site blocks (photos, prism, photos2) remained in the Caddyfile.

Root cause: The Caddyfile was manually edited directly on LXC 121 (not via the dtoro/caddy-conf git repo), overwriting 260 lines / 30+ site blocks with 43 lines of photo-only config.

Fix:

  • Restored Caddyfile from origin/master (git checkout --force origin/master -- Caddyfile)
  • systemctl reload caddy

Permanent safeguards added to /etc/caddy/scripts/deploy.sh:

  • Site-count guard: refuses to reload if fewer than 20 *.hubris.network blocks detected
  • Dirty-tree auto-stash: stashes local changes before git pull --ff-only so the webhook doesn't fail on local edits
  • Auto-backup: saves Caddyfile.bak.<timestamp> before any modifications, keeps last 5

Also: elementsynapse LXC 118 found to have DHCP-overridden static IP (actual .244 vs config .239) during incident investigation — fixed.

2026-06-02 — caddy.service unit missing; recreated

After the Slate AX → SODOLA network migration, Caddy was not listening (ports 80/443 dead). Root cause: the custom hubris1 Debian package (caddy_1:2.11.3-hubris1_amd64) does not ship a systemd service unit file. The unit had previously existed but was lost (likely on a package reinstall). Recreated at /lib/systemd/system/caddy.service with standard Caddy service config + EnvironmentFile=/etc/caddy/caddy.env (already present in caddy.service.d/override.conf). Risk: the unit will be lost again if the package is reinstalled without the file being tracked. Fix: add the service unit to the caddy-conf repo or rebuild the hubris1 package to include it.

2026-04-28 — wiki entry created

Initial documentation. 16 active sites at this date.

2026-04-22 — Artifacto + Authentik gateway-secret pattern wired

Caddy site artifacto.hubris.network: forward-auth on admin paths, header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}, public matchers /p/*, /static/*, /healthz. caddy.env extended with the gateway secret.

2026-04-21 — (authentik) snippet added

Top-of-file snippet used by every gated site. Targets http://192.168.8.180:9000 directly to dodge hairpin TLS round-trip.

2026-04-21 — three new sites added (jellyseerr, qbit, sab → 192.168.8.132)

For the arriman (122) docker stack. Caddy + certs work; needed corresponding DNS split-horizon entries to be added to land cleanly.

2026-04-20 — auto-deploy pipeline shipped

Repo dtoro/caddy-conf. Webhook receiver at :9797, validate + reload on push to master.

Reference in New Issue View Git Blame Copy Permalink