From c8d7ed65c65b8b6a1e66a99bda9980e292441382 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 26 Aug 2026 02:16:42 -0700 Subject: [PATCH] fix: use tls_insecure_skip_verify token (this Caddy build has no tls{} transport sub-block) Caddy v2.11.4's caddyfile adapter rejects 'tls { insecure_skip_verify }' inside transport http (unrecognized subdirective '{') and also rejects the handler-level form. The working form, verified live against PMS with a throwaway caddy (200 OK), is the bare token: reverse_proxy 192.168.0.235:32400 { transport http { tls_insecure_skip_verify } } --- dankclaw/Caddyfile | 8 ++------ docs/Infrastructure/Caddy.md | 2 +- tests/caddyfile.bats | 4 ++-- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index f7da7c2..11304af 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -192,9 +192,7 @@ pihole.franksdank.cloud { http://plex.franksdank.casa { reverse_proxy 192.168.0.235:32400 { transport http { - tls { - insecure_skip_verify - } + tls_insecure_skip_verify } } } @@ -207,9 +205,7 @@ http://plex.franksdank.casa { plex.franksdank.cloud { reverse_proxy 192.168.0.235:32400 { transport http { - tls { - insecure_skip_verify - } + tls_insecure_skip_verify } } } diff --git a/docs/Infrastructure/Caddy.md b/docs/Infrastructure/Caddy.md index 9061a4e..a2bb061 100644 --- a/docs/Infrastructure/Caddy.md +++ b/docs/Infrastructure/Caddy.md @@ -46,7 +46,7 @@ Every vhost uses the flat `franksdank.cloud` convention. The full list lives in | Dankclaw quadlet services | by published LAN port, e.g. `192.168.0.143:3000` (Gitea) | | Dankserver services | by published LAN port, e.g. `192.168.0.235:8085` (RomM) | -The bare-IP catch-all `:80` 302-redirects to `https://dankclaw.franksdank.cloud/`. The legacy name `dankserver.franksdank.cloud` 302-redirects there too. `plex.franksdank.casa` is the only plain-HTTP vhost; it cannot get a DNS-01 cert because `franksdank.casa` is not in the Porkbun account. The canonical Plex name is `plex.franksdank.cloud`. Both Plex vhosts dial PMS **over TLS upstream** (`transport http { tls { insecure_skip_verify } }`): PMS 1.43.x silently closes plain-HTTP connections from non-loopback sources (diagnosed 2026-08-26 — it accepts, reads the request, and FINs without responding), which surfaced here as an empty-body 502 (blank page in browsers). `insecure_skip_verify` applies only to this pinned-LAN hop (PMS serves a self-signed cert); client-facing Let's Encrypt TLS is unchanged. The Plex web UI is at `/web/`; `/` returns the XML `MediaContainer` index. +The bare-IP catch-all `:80` 302-redirects to `https://dankclaw.franksdank.cloud/`. The legacy name `dankserver.franksdank.cloud` 302-redirects there too. `plex.franksdank.casa` is the only plain-HTTP vhost; it cannot get a DNS-01 cert because `franksdank.casa` is not in the Porkbun account. The canonical Plex name is `plex.franksdank.cloud`. Both Plex vhosts dial PMS **over TLS upstream** (`transport http { tls_insecure_skip_verify }` — in this Caddy build the flag is a bare token inside the transport block, not a `tls {}` sub-block): PMS 1.43.x silently closes plain-HTTP connections from non-loopback sources (diagnosed 2026-08-26 — it accepts, reads the request, and FINs without responding), which surfaced here as an empty-body 502 (blank page in browsers). `insecure_skip_verify` applies only to this pinned-LAN hop (PMS serves a self-signed cert); client-facing Let's Encrypt TLS is unchanged. The Plex web UI is at `/web/`; `/` returns the XML `MediaContainer` index. ## Basic auth diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats index 3e1aa12..8162690 100644 --- a/tests/caddyfile.bats +++ b/tests/caddyfile.bats @@ -103,8 +103,8 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile" || { echo "$name: missing PMS upstream"; return 1; } echo "$block" | grep -q 'transport http' \ || { echo "$name: upstream must use the http transport with TLS"; return 1; } - echo "$block" | grep -q 'insecure_skip_verify' \ - || { echo "$name: TLS upstream must skip PMS self-signed cert verification"; return 1; } + echo "$block" | grep -q 'tls_insecure_skip_verify' \ + || { echo "$name: TLS upstream must set tls_insecure_skip_verify (PMS self-signed cert)"; return 1; } done }