[glm-grade=B+] ops: self-healing watchdog for DNS2 (container, port 3001, Caddyfile, caddy)

30s systemd timer heals four real failure classes: container down (docker
start -> start.sh fallback), rogue host process on :3001, Caddyfile wiped
by foreign generators (known-good snapshot + size/site-block/marker
gates), caddy down/not serving. Telegram alerts with 15-min per-class
cooldown; stamp only burned on successful send. Adversarial review B-
(both blockers fixed: snapshot poisoning via multi-gate integrity +
refresh lockout, deployment). Live kill-tested twice: full recovery in
one cycle, alerts delivered, cooldown verified.

This commit is contained in:

Krystie

2026-08-14 23:59:50 -07:00

parent ff92706f8a

commit 86cc21c7a4

3 changed files with 288 additions and 0 deletions

									
										ops/watchdog/dashcaddy-watchdog.timer
									
		+10
		
												View File
												
				@@ -0,0 +1,10 @@

				[Unit]

				Description=Run DashCaddy watchdog every 30 seconds

				[Timer]

				OnBootSec=2min

				OnUnitActiveSec=30s

				AccuracySec=5s

				[Install]

				WantedBy=timers.target