0 Fork 0

Files

T

Frank 9bfa0be85d chore(skills): promote runbook skills to managed-skills; drop superseded SKILL.md

- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap
  runbooks etc.) now tracked.
- Removed superseded skills: omp_harness_config, peon_ping_integration
  (replaced by user-authored peon-ping-* managed skills),
  rocmfp4-strix-benchmark-orchestration.
- New memory-root skills: niri_compositor_ops, omp_git_workflow,
  omp_model_config, quadlet-media-migration, homelab-service-triage,
  hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.

2026-09-09 16:20:28 -07:00

2.0 KiB

Raw Blame History

name, description

name	description
vhost-proxy-health-probes	Verify reverse-proxied homelab services from the client side with status-code probe batteries; decode 404/502/login-page answers instead of trusting 200s

vhost proxy health probes

After deploying or auditing a Caddy/Anubis-style front door, verify services from a client, not from the backend's localhost — that is where transport mismatches, auth walls, and dead upstreams show up.

Probe battery (per vhost, from a LAN client)

curl -s -o /dev/null -m 6 -w "%{http_code}\n" https://<vhost>/ping
curl -s -o /dev/null -m 6 -w "%{http_code}\n" https://<vhost>/

Decoding the answer — a status code is a diagnosis, not a failure

200 on /ping from *arrs = alive; auth ON/OFF unknown (/ping bypasses auth by design) — probe / to decide.
404 = backend alive, route missing (qBittorrent has no /ping; 404 there = healthy).
502 = Caddy could not reach/negotiate with the upstream: dead backend or transport mismatch. Probe the backend port directly from the proxy's network (ssh <proxy-host> curl http://<backend>:<port>/...). Direct 200 + vhost 502 ⇒ config bug, not an outage.
Login page to anonymous (grep body for password) = auth ON; instant redirect to /transferlist/-style routes = auth OFF = open door.

Transport-mismatch mechanism

transport http {versions h2c 1.1} makes Caddy send an h2c upgrade preface; .NET/Kestrel backends (Jellyfin) reject it → 502 per request while the same port answers 200 on plain HTTP/1.1. Fix = drop the transport override (default HTTP/1.1). Opposite twin: Plex PMS drops plain HTTP off-loopback and needs a TLS transport. Match the transport to what the backend speaks.

Shell trap when gating commits on a test suite

grep -c "^not ok" exits 1 when zero mismatches — inside an && chain it silently kills everything after it while still printing 0. Wrap: (./tests/run.sh | grep -cE '^not ok' || true) && git commit ....

2.0 KiB Raw Blame History