From 0f04bb363849018675a84b9850b4af586ef8c48b Mon Sep 17 00:00:00 2001 From: Krystie Date: Wed, 8 Jul 2026 22:00:25 -0700 Subject: [PATCH] DC-044: mount Sami CA + fix ca.sami /etc/hosts in DashCaddy container Two related fixes from the dashboard 11/15 false-negatives: 1. The Sami Home Network CA cert (/etc/ssl/sami-ca/root.crt) was not mounted into the container, so the health-checker's HTTPS probe to *.sami hosts failed with "certificate verify failed". Added a bind mount + CA_CERT_PATH env var so the app's httpsAgent picks it up (verified at startup: "HTTPS agent configured with CA certificate"). 2. The --add-host=ca.sami:127.0.0.1 line pinned ca.sami to the container's loopback, but nothing listens on 443 inside the container. Probe failed with ECONNREFUSED 127.0.0.1:443. Removed the override so ca.sami resolves via DNS to 100.121.150.22 (Caddy on DNS2) and the probe reaches the real service. After both fixes: 15/15 services healthy, 0 429s on the health checker, caddy.ok=true on /health/ready. --- start.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/start.sh b/start.sh index 37ef70d..0587cef 100755 --- a/start.sh +++ b/start.sh @@ -41,7 +41,10 @@ ADD_HOST_FLAGS=( --add-host=dns1.sami:100.71.97.12 --add-host=dc-contabo-de:100.98.123.59 --add-host=git.dashcaddy.net:100.98.123.59 - --add-host=ca.sami:127.0.0.1 + # ca.sami resolves via DNS to 100.121.150.22 (Caddy on DNS2). Don't pin + # to 127.0.0.1 — nothing listens on 443 inside the container, so the + # health checker would fail with ECONNREFUSED. The CA itself is a + # public-facing service that goes through Caddy just like every other *.sami. ) # Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist) @@ -74,6 +77,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \ -v /opt/sami-files/logs:/opt/sami-files/logs:ro \ -v /usr/bin/tailscale:/usr/bin/tailscale:ro \ -v /var/run/tailscale:/var/run/tailscale:ro \ + -v /etc/ssl/sami-ca:/etc/ssl/sami-ca:ro \ -e NODE_ENV=production \ -e SERVICES_FILE=/app/data/services.json \ -e CONFIG_FILE=/app/data/config.json \ @@ -88,4 +92,5 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \ -e ASSETS_DIR=/app/assets \ -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \ -e DASHCADDY_UPDATE_ENABLED=false \ + -e CA_CERT_PATH=/etc/ssl/sami-ca/root.crt \ ${IMAGE} \ No newline at end of file