From 39f0e0d8d4ce8febdc09db5fa66462c5966c825a Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 2 Oct 2026 12:23:56 -0700 Subject: [PATCH] =?UTF-8?q?plex:=20probe=20the=20readiness=20gate=20over?= =?UTF-8?q?=20HTTPS=20=E2=80=94=20PMS=20drops=20plain=20HTTP=20off-loopbac?= =?UTF-8?q?k?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit deploy_plex gated on `curl http://127.0.0.1:32400/identity`, which can never succeed: Plex accepts the TCP connection (it arrives on the container's eth0) and then answers with nothing, so curl reports "Empty reply from server" (52). Measured 2026-10-02 on a plex that was healthy the whole time — `https://127.0.0.1:32400/identity` returned 200 in 44 ms while the gate burned its full 600 s and failed the deploy. The repo already knew this law in another place: tests/caddyfile.bats pins the plex vhosts to a TLS upstream with the comment "PMS drops plain HTTP off-loopback". The deployer's gate never got the same treatment, and plex's per-service revision had been behind long enough that the gate had not run against this posture until now. -k because PMS serves its own self-signed cert on 32400. --- scripts/deploy-remote.sh | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh index f26fb2b..6acae9d 100755 --- a/scripts/deploy-remote.sh +++ b/scripts/deploy-remote.sh @@ -935,15 +935,24 @@ deploy_plex() { fi systemctl --user restart plex.service # Readiness gate: /identity answers MediaContainer XML once PMS is up. + # + # HTTPS, NOT HTTP. PMS drops plain HTTP off-loopback: the probe's + # connection arrives on the container's eth0, so an http:// request is + # accepted and then answered with nothing (curl 52, Empty reply) against a + # perfectly healthy server. Measured 2026-10-02 — the gate burned its full + # 600s and failed a plex whose https://127.0.0.1:32400/identity answered + # 200 in 44 ms the whole time. The same law is why the Caddyfile dials the + # plex upstream over TLS (tests/caddyfile.bats pins it). + # -k: PMS presents its own self-signed cert on 32400. + # # Reality check from the 2026-09 cutover: the FIRST container boot of a - # years-old library ran ~10 min (PMS pre-binds 32400 during boot and - # empty-replies until the HTTP layer is ready), so the gate allows 600s. + # years-old library ran ~10 min, so the gate still allows 600s. # Fail the deploy (pending state preserved) rather than mark it deployed blind. for ((i = 1; i <= 120; i++)); do - curl -fsS --max-time 3 http://127.0.0.1:32400/identity >/dev/null && return 0 + curl -fsSk --max-time 3 https://127.0.0.1:32400/identity >/dev/null && return 0 sleep 5 done - echo "FAIL: plex did not answer /identity within 600s" >&2 + echo "FAIL: plex did not answer /identity over HTTPS within 600s" >&2 return 1 }