From 56763e014ede58c2133797b347f4c02ff716b422 Mon Sep 17 00:00:00 2001 From: Frank Date: Sun, 30 Aug 2026 04:43:15 -0700 Subject: [PATCH] fix(hermes): point the signal adapter at the verified alias path and route hermes.franksdank.cloud to the dashboard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway's SIGNAL_HTTP_URL pointed at the host LAN IP. From container space on netavark networks only DNAT'd published ports accept connections to that address; :8080 has no forward, so every connection was refused and the Signal adapter stayed disconnected since the Aug 26 reboot. host.containers.internal is the verified working path (probed live from a probe container on dankclaw_default). The public hostname also routed to hermes:8090, which serves nothing — the gateway has no HTTP listener. It now routes to the dashboard's login- gated admin UI on :9119, behind the existing Anubis+Authentik guard. --- dankclaw/Caddyfile | 2 +- dankclaw/compose.yaml | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index 3d46d08..5494d03 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -284,7 +284,7 @@ http://:8017 { @hermes host hermes.franksdank.cloud handle @hermes { - reverse_proxy hermes:8090 + reverse_proxy 192.168.0.143:9119 } @prometheus host prometheus.franksdank.cloud diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml index 77e19c5..14d065c 100644 --- a/dankclaw/compose.yaml +++ b/dankclaw/compose.yaml @@ -62,10 +62,11 @@ services: HERMES_DATA_DIR: /data # Point hermes's config/.env at the mounted data dir (persistent). HERMES_HOME: /data - # Signal adapter -> the host signal-cli daemon. The slirp host alias - # (host.containers.internal) can drop at runtime; the host LAN IP is the - # stable container->host path. 127.0.0.1 inside the container is not the host. - SIGNAL_HTTP_URL: "http://192.168.0.143:8080" + # Signal adapter -> the host signal-cli daemon (:8080, host process). + # From container space the host LAN IP only accepts connections to + # published ports (netavark DNAT); un-forwarded host ports refuse + # instantly. The gateway alias is the verified working path (2026-08-30). + SIGNAL_HTTP_URL: "http://host.containers.internal:8080" SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}" SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}" ports: