sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

DC-044: mount Sami CA + fix ca.sami /etc/hosts in DashCaddy container
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source 
Two related fixes from the dashboard 11/15 false-negatives:

1. The Sami Home Network CA cert (/etc/ssl/sami-ca/root.crt) was not
   mounted into the container, so the health-checker's HTTPS probe to
   *.sami hosts failed with "certificate verify failed". Added a bind
   mount + CA_CERT_PATH env var so the app's httpsAgent picks it up
   (verified at startup: "HTTPS agent configured with CA certificate").

2. The --add-host=ca.sami:127.0.0.1 line pinned ca.sami to the
   container's loopback, but nothing listens on 443 inside the
   container. Probe failed with ECONNREFUSED 127.0.0.1:443. Removed
   the override so ca.sami resolves via DNS to 100.121.150.22 (Caddy
   on DNS2) and the probe reaches the real service.

After both fixes: 15/15 services healthy, 0 429s on the health checker,
caddy.ok=true on /health/ready.
This commit is contained in:
Krystie
2026-07-08 22:00:25 -07:00
parent 2169ec9853
commit 0f04bb3638
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
start.sh
+6 -1
View File
@@ -41,7 +41,10 @@ ADD_HOST_FLAGS=(
--add-host=dns1.sami:100.71.97.12 --add-host=dns1.sami:100.71.97.12
--add-host=dc-contabo-de:100.98.123.59 --add-host=dc-contabo-de:100.98.123.59
--add-host=git.dashcaddy.net:100.98.123.59 --add-host=git.dashcaddy.net:100.98.123.59
--add-host=ca.sami:127.0.0.1 # ca.sami resolves via DNS to 100.121.150.22 (Caddy on DNS2). Don't pin
# to 127.0.0.1 — nothing listens on 443 inside the container, so the
# health checker would fail with ECONNREFUSED. The CA itself is a
# public-facing service that goes through Caddy just like every other *.sami.
) )
# Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist) # Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist)
@@ -74,6 +77,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
-v /opt/sami-files/logs:/opt/sami-files/logs:ro \ -v /opt/sami-files/logs:/opt/sami-files/logs:ro \
-v /usr/bin/tailscale:/usr/bin/tailscale:ro \ -v /usr/bin/tailscale:/usr/bin/tailscale:ro \
-v /var/run/tailscale:/var/run/tailscale:ro \ -v /var/run/tailscale:/var/run/tailscale:ro \
-v /etc/ssl/sami-ca:/etc/ssl/sami-ca:ro \
-e NODE_ENV=production \ -e NODE_ENV=production \
-e SERVICES_FILE=/app/data/services.json \ -e SERVICES_FILE=/app/data/services.json \
-e CONFIG_FILE=/app/data/config.json \ -e CONFIG_FILE=/app/data/config.json \
@@ -88,4 +92,5 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
-e ASSETS_DIR=/app/assets \ -e ASSETS_DIR=/app/assets \
-e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \ -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
-e DASHCADDY_UPDATE_ENABLED=false \ -e DASHCADDY_UPDATE_ENABLED=false \
-e CA_CERT_PATH=/etc/ssl/sami-ca/root.crt \
${IMAGE} ${IMAGE}