Frank
8660209c35
Caddy left compose.yaml for a quadlet unit (caddy.service): joins dankclaw_default for container-name upstreams, Pull=never for the local-only image, Porkbun credentials via /home/dank/Containers/caddy/env written by deploy from .env, bare-IP-catch-all health check. deploy_caddy installs, enables, and starts the unit after retiring the bare container (state is in host volumes). Pi-hole: the repo now owns the sysctl drop-in (dankclaw/pihole/sysctl/99-dnsmasq.conf, ip_unprivileged_port_start=53); deploy_pihole installs it to /etc/sysctl.d/, stages conflicting later-sorted drop-ins in the home trash, and applies 'sysctl --system' (the boot code path). This fixes the 2026-08-26 crash loop (port-53 bind denied, restart counter 1645) caused by a second drop-in resetting the value to 80. Tests: new caddy_quadlet.bats seam; caddyfile/deployment_flow assertions repointed from the removed compose service to the quadlet; pihole.bats pins the sysctl drop-in and its deployment; test-changed.sh routes dankclaw/caddy/ and the pihole subtree to their seams. Docs: Caddy, Pi-hole, Dankclaw Stack, work log.
9 lines
548 B
Plaintext
9 lines
548 B
Plaintext
# Rootless DNS must bind port 53: lower the unprivileged-port threshold so a
|
|
# rootless container may publish 0.0.0.0:53 (80/443 stay allowed; 53 < 80).
|
|
# Single source of truth for net.ipv4.ip_unprivileged_port_start on dankclaw;
|
|
# deploy_pihole installs it to /etc/sysctl.d/ and applies it with
|
|
# `sysctl --system` (the same code path boot uses via systemd-sysctl).
|
|
# A later-sorted drop-in that reset this to 80 took LAN DNS down after the
|
|
# 2026-08-26 reboot — deploy_pihole neutralizes such conflicts.
|
|
net.ipv4.ip_unprivileged_port_start=53
|