dank/serverAppConfigs
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

hermes vhost: dial netavark's host address, not the LAN IP (fixes the 502)

Browse Source 
hermes-webui is Network=host, so 8787 is a bare host-netns bind, and netavark
DNATs only *published* ports. From Caddy's bridge netns 192.168.0.143:8787 and
10.89.1.1:8787 are both refused, while host.containers.internal:8787
(169.254.1.2) answers 200 — measured live 2026-09-16 from inside the Caddy
container. The dashboard's published 9119 answers on that same LAN IP, which is
what made the old upstream look sound.

The vhost comment asserted "192.168.0.143:8787 is open" from that bridge; it is
not, so the claim is replaced with the measurement, and the hermes-webui quadlet
comment carries the same correction. The seam guarding this invariant accepted
any numeric upstream, so the LAN IP passed it; it now pins the measured-working
form and fails on the LAN IP (teeth verified by substitution).
This commit is contained in:
Frank committed 2026-09-16 19:28:34 -07:00
1 parent 65fbef63dc
commit d14e0a94eb
3 files changed
+30 -15
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

dankclaw/Caddyfile
+8 -5
View File
@@ -176,12 +176,15 @@ pihole.franksdank.cloud {
# here enters the http://:8016 auth chain. Internal-only by DNS absence: there is
# no public Porkbun A record for this name, so only LAN clients (Pi-hole
# addn-hosts → 192.168.0.143) can resolve it at all; DNS-01 issuance via the
# Porkbun module needs no public record. Upstream is the host LAN IP rather than
# localhost because Caddy itself lives on dankclaw_default: from that bridge the
# gateway address 10.89.1.1 has nothing serving 8787 (connection refused), while
# 192.168.0.143:8787 is open.
# Porkbun module needs no public record. Upstream is `host.containers.internal`
# — netavark's host address, 169.254.1.2 — NOT the host LAN IP: hermes-webui is
# `Network=host`, so 8787 is a host-netns bind and not a published port, and
# netavark DNATs only published ports (192.168.0.143:9119, the dashboard below,
# answers from this bridge; 192.168.0.143:8787 does not). Measured live
# 2026-09-16 inside the Caddy container: 192.168.0.143:8787 and 10.89.1.1:8787
# both REFUSED, host.containers.internal:8787 → 200.
hermes.franksdank.cloud {
reverse_proxy 192.168.0.143:8787
reverse_proxy host.containers.internal:8787
}
# --- Hermes dashboard (admin UI; published 9119 on dankclaw_default) --------