Frank
9bfa0be85d
- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap runbooks etc.) now tracked. - Removed superseded skills: omp_harness_config, peon_ping_integration (replaced by user-authored peon-ping-* managed skills), rocmfp4-strix-benchmark-orchestration. - New memory-root skills: niri_compositor_ops, omp_git_workflow, omp_model_config, quadlet-media-migration, homelab-service-triage, hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.
31 lines
2.0 KiB
Markdown
31 lines
2.0 KiB
Markdown
---
|
|
name: vhost-proxy-health-probes
|
|
description: Verify reverse-proxied homelab services from the client side with status-code probe batteries; decode 404/502/login-page answers instead of trusting 200s
|
|
---
|
|
|
|
# vhost proxy health probes
|
|
|
|
After deploying or auditing a Caddy/Anubis-style front door, verify services **from a client**, not from the backend's localhost — that is where transport mismatches, auth walls, and dead upstreams show up.
|
|
|
|
## Probe battery (per vhost, from a LAN client)
|
|
|
|
```
|
|
curl -s -o /dev/null -m 6 -w "%{http_code}\n" https://<vhost>/ping
|
|
curl -s -o /dev/null -m 6 -w "%{http_code}\n" https://<vhost>/
|
|
```
|
|
|
|
## Decoding the answer — a status code is a diagnosis, not a failure
|
|
|
|
- `200` on `/ping` from *arrs = alive; **auth ON/OFF unknown** (`/ping` bypasses auth by design) — probe `/` to decide.
|
|
- `404` = backend **alive**, route missing (qBittorrent has no `/ping`; 404 there = healthy).
|
|
- `502` = Caddy could not reach/negotiate with the upstream: dead backend **or transport mismatch**. Probe the backend port directly from the proxy's network (`ssh <proxy-host> curl http://<backend>:<port>/...`). Direct 200 + vhost 502 ⇒ config bug, not an outage.
|
|
- Login page to anonymous (grep body for `password`) = auth ON; instant redirect to `/transferlist/`-style routes = auth OFF = open door.
|
|
|
|
## Transport-mismatch mechanism
|
|
|
|
`transport http {versions h2c 1.1}` makes Caddy send an h2c upgrade preface; .NET/Kestrel backends (Jellyfin) reject it → 502 per request while the same port answers 200 on plain HTTP/1.1. Fix = drop the transport override (default HTTP/1.1). Opposite twin: Plex PMS drops *plain* HTTP off-loopback and needs a TLS transport. Match the transport to what the backend speaks.
|
|
|
|
## Shell trap when gating commits on a test suite
|
|
|
|
`grep -c "^not ok"` exits **1 when zero mismatches** — inside an `&&` chain it silently kills everything after it while still printing `0`. Wrap: `(./tests/run.sh | grep -cE '^not ok' || true) && git commit ...`.
|