ginnoirandClaude Opus 5
f70963e166
Deploy Caddyfile to valhalla / deploy (push) Successful in 1m32s
The LAN resolver (OPNsense Unbound) is authoritative for ginnoir.com via the
split-horizon override, but its local-zone holds only A records, so
`SOA ginnoir.com` returns NODATA. certmagic's zone lookup walks up the label
chain hunting for an SOA, finds none at ginnoir.com, climbs to `com.`, and asks
Cloudflare for a `com` zone:
adding temporary record for zone "com.": expected 1 zone, got 0 for com.
Every DNS-01 renewal has failed for ~17 days (attempt 91 on the oldest), and
Caddy fell back to the LE staging endpoint. Certs began expiring as they rolled
off: 5etools (-4d), files (-1.9d), auth (-15.6h), fam (-15.6h), with ~20 more
queued behind them.
The expired auth.ginnoir.com cert is what broke Nextcloud SSO: its server-side
discovery fetch fails TLS verification ("certificate has expired"), and
user_oidc's LoginController catches that and returns 404 "provider unreachable".
Browsers were unaffected because they let you click through an expired cert;
PHP/curl does not.
Pinning 1.1.1.1/1.0.0.1 on the caddy container sends the SOA lookup to public
DNS. Verified Docker's embedded resolver still serves container names and the
gitea.ginnoir.com alias, which take priority over the external servers.
Also corrects the imgstudio comment, which credited its working TLS to avoiding
a "false .com" in the hostname. The actual reason was its explicit `resolvers`
line -- the same fix, applied to one site.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
2.5 KiB
YAML
64 lines
2.5 KiB
YAML
# proxy stack — Caddy reverse proxy / TLS terminator.
|
|
#
|
|
# Caddy is the single ingress for the whole estate. It joins only the shared
|
|
# `edge` network (owned by the management plane); every service it proxies also
|
|
# joins `edge`, so `reverse_proxy <service>:<port>` resolves by container name.
|
|
# This replaces Caddy's old membership in 11 separate per-stack networks.
|
|
#
|
|
# The Caddyfile itself is unchanged — upstreams are service names that resolve
|
|
# over edge. It is bind-mounted from /config/caddy/Caddyfile and hot-reloaded
|
|
# by the Gitea Actions runner on push (.gitea/workflows/deploy-caddy.yml).
|
|
#
|
|
# serfriz/caddy-cloudflare-ddns bundles caddy-dns/cloudflare (DNS-01 ACME),
|
|
# caddy-cloudflare-ip (real client IPs behind CF), caddy-dynamicdns.
|
|
|
|
services:
|
|
caddy:
|
|
container_name: caddy
|
|
image: serfriz/caddy-cloudflare-ddns:2.11.3
|
|
restart: unless-stopped
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
# Public resolvers for ACME DNS-01 zone detection.
|
|
#
|
|
# The LAN resolver (OPNsense Unbound, 192.168.1.1) is authoritative for
|
|
# ginnoir.com via the split-horizon override, but its local-zone only holds
|
|
# A records — so `SOA ginnoir.com` returns NODATA. certmagic's zone lookup
|
|
# walks up the label chain looking for an SOA, finds none at ginnoir.com,
|
|
# climbs to `com.`, and asks Cloudflare for a `com` zone. Result:
|
|
# "adding temporary record for zone \"com.\": expected 1 zone, got 0"
|
|
# and every DNS-01 renewal fails until certs expire.
|
|
#
|
|
# Docker's embedded DNS (127.0.0.11) still resolves container names and the
|
|
# gitea.ginnoir.com alias below; only external lookups go to Cloudflare.
|
|
dns:
|
|
- 1.1.1.1
|
|
- 1.0.0.1
|
|
networks:
|
|
edge:
|
|
aliases:
|
|
- gitea.ginnoir.com
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
env_file:
|
|
- stack.env
|
|
volumes:
|
|
- /config/caddy/Caddyfile:/etc/caddy/Caddyfile
|
|
- /config/caddy/site:/srv
|
|
- /config/caddy/data:/data
|
|
- /config/caddy/config:/config
|
|
- /storage1/Books:/srv/Books
|
|
# Pokémon ROM-hack library (box art + guides + spreadsheets), served
|
|
# read-only and LAN-only by the romhacks-files.ginnoir.com site so the
|
|
# Obsidian catalog notes can embed art and link guides.
|
|
- /storage1/labdata/romhacks/library:/srv/romhacks:ro
|
|
# ROM files are exposed only through romhacks-files.ginnoir.com/_roms/*
|
|
# and that site imports internal_only in the Caddyfile.
|
|
- /storage1/Emulation/roms:/srv/roms:ro
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
external: true
|