Files

T

Frank da68b5ce1a fix: basicauth double-prefix render; open-webui off slirp4netns

basicauth (2026-08-22 incident):
- the Caddyfile template carried its own $2a$14$ prefix and deploy.sh
  substituted the full hash (prefix included), rendering an invalid
  double-prefixed hash. Every basicauth vhost rejected every password
  with 401 and Caddy logged nothing.
- template is now a bare REPLACE_WITH_HASH token; tests pin the render
  contract (no prefix in template; rendered line is exactly 'dank <hash>').

open-webui (2026-08-22 incident):
- its slirp4netns helper process died, leaving the container running
  with only 'lo' in its netns: port 3005 accepted TCP and reset every
  request, so chat served empty responses for ~2 days, unlogged.
- move to a pinned bridge network (systemd-open-webui, 10.89.3.0/24,
  gw 10.89.3.1) — no per-container helper to die.
- LLM endpoint reached via the gateway (host.containers.internal is
  slirp-only): OPENAI_API_BASE_URL=http://10.89.3.1:52625.
- add a quadlet healthcheck: /health (app) + non-loopback interface
  (network liveness; the dead-tap state leaves only 'lo').
- deploy script now copies the .network file too.
- docs updated (OpenWebUI History section, Caddy basic-auth contract).

2026-08-22 13:07:43 -07:00

4.2 KiB

Raw Blame History

Caddy

Caddy is the single reverse proxy for both hosts. It runs as a container on Dankclaw (192.168.0.143), terminates TLS with real Let's Encrypt certificates, routes hostnames to containers on both hosts, and protects the homepage and sensitive services with HTTP basic auth.

Docs: https://caddyserver.com/docs

Facts (live inventory)

Item	Value
Image	`franksdank/caddy-porkbun:latest` (local build, `dankclaw/caddy/Containerfile`)
Config	`/home/dank/Containers/caddy/Caddyfile` (bind mount, rendered by deploy)
Data	`/home/dank/Containers/caddy/data` (certs) and `.../config` (ACME state)
Ports	80, 443 on 192.168.0.143
TLS	Let's Encrypt, DNS-01 via the Porkbun module (one cert per vhost)
Runs on	Dankclaw only — Dankserver has no Caddy

The Caddyfile in git (dankclaw/Caddyfile) carries a REPLACE_WITH_HASH placeholder. scripts/deploy.sh renders the real basicauth hash from the host .env (CADDY_BASICAUTH_HASH) into the mounted path before up. See Deployment Flow.

The porkbun image

Stock Caddy cannot solve the ACME challenge because the router exposes no inbound port 80/443. The local image adds the github.com/caddy-dns/porkbun module, which answers the DNS-01 challenge by creating and deleting a _acme-challenge TXT record through the Porkbun API. No inbound port is needed. Rebuild only when Caddy or the module needs an update:

podman build -t franksdank/caddy-porkbun:latest -f dankclaw/caddy/Containerfile .

The Caddyfile references the credentials through the environment:

acme_dns porkbun {
    api_key {env.PORKBUN_API_KEY}
    api_secret_key {env.PORKBUN_API_SECRET_KEY}
}

compose passes both variables from the host .env. Keep the real keys in .env only; .env.example holds placeholders. The Porkbun account holds only franksdank.cloud.

Vhost map

Every vhost uses the flat franksdank.cloud convention. The full list lives in dankclaw/Caddyfile. Routing by host:

Upstream	Reach
Dankclaw services (compose network)	by container name, e.g. `comfyui:8188`
Dankclaw quadlet services	by published LAN port, e.g. `192.168.0.143:3000` (Gitea)
Dankserver services	by published LAN port, e.g. `192.168.0.235:8085` (RomM)

The bare-IP catch-all :80 302-redirects to https://dankclaw.franksdank.cloud/. The legacy name dankserver.franksdank.cloud 302-redirects there too. plex.franksdank.casa is the only plain-HTTP vhost; it cannot get a DNS-01 cert because franksdank.casa is not in the Porkbun account. The canonical Plex name is plex.franksdank.cloud.

Basic auth

The Caddyfile in git carries a bare placeholder; deploy.sh substitutes the full hash from the host .env (CADDY_BASICAUTH_HASH):

chat.franksdank.cloud {
    basicauth {
        dank REPLACE_WITH_HASH
    }
    reverse_proxy 192.168.0.143:3005
}

After rendering, the line reads dank $2a$14$xxxx… (one complete hash). Do not put a $2a$14$ prefix in the template: it would render a double-prefixed, invalid hash (2026-08-22 incident — every basicauth vhost returned 401 for every password). tests/deployment_flow.bats pins the render contract.

The homepage also uses basic auth; see Homepage.

Operations

Validate before a reload:

caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile

Certificates and ACME state live in the caddy data volume. Back it up with the stack. Each vhost owns one certificate; renewals are automatic and also use DNS-01.

Gotchas

The basicauth template must stay a bare REPLACE_WITH_HASH token (no $2a$14$ prefix) — the rendered value is the complete hash. A double prefix silently rejects every password with 401; no Caddy error is logged.
A new vhost needs three things: a dnsmasq addn-hosts line, a Porkbun A record, and the Caddyfile block. See LAN-DNS.
The G36 has no NAT loopback, so LAN clients must resolve the name to the LAN IP. That is the dnsmasq role in LAN-DNS.
Caddy serves HTTPS on 443 and HTTP on 80 (redirects). The router needs no 80/443 port forward for LAN use.

4.2 KiB Raw Blame History