From 95f558c49f80571e5cfd5a385e58be76d0a57530 Mon Sep 17 00:00:00 2001 From: Krystie Date: Fri, 3 Jul 2026 00:08:55 -0700 Subject: [PATCH] DC-030: bake /etc/hosts overrides into start.sh (fix git.sami resolution in container) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The container's health-checker runs against Caddy via /etc/hosts resolution. The node:20-alpine base image has no entries for *.sami, so without explicit --add-host flags every *.sami probe resolves via the configured DNS server (100.121.150.22 Technitium or 8.8.8.8) — both of which DO resolve *.sami but return the WAN/Tailscale IP. That works for most services because Caddy on DNS2:443 handles them. BUT: a previous container run passed --add-host=git.sami:100.81.59.99 (DNS3's Tailscale IP). DNS3 does NOT serve HTTPS on 443 — Gitea listens on :3030 only. So git.sami health checks inside the container hit DNS3:443, get ECONNREFUSED, and the dashboard shows git.sami as down even though Caddy on DNS2:443 correctly routes git.sami → 100.81.59.99:3030. Fix: inject the correct --add-host flags from start.sh (the source of truth for container setup) so future recreates get consistent resolution. git.sami is intentionally left OUT — Caddy on DNS2:443 is the only correct ingress for git.sami traffic. Also documents the rationale so the next person doesn't reintroduce the git.sami override by accident. Live verified: - container /etc/hosts has all needed entries except git.sami - curl https://git.sami/ from inside container → 200 (via Caddy on :443) - curl https://sync.sami/ from inside container → 302 (upstream redirect) - curl https://router.sami/ from inside container → 302 (upstream redirect) --- start.sh | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/start.sh b/start.sh index 615e324..be7a8b7 100755 --- a/start.sh +++ b/start.sh @@ -14,6 +14,36 @@ HOST_IP="172.17.0.1" DNS_PRIMARY="100.121.150.22" # Technitium (Tailscale IP) — resolves *.sami DNS_FALLBACK="8.8.8.8" +# --- /etc/hosts overrides for the container --------------------------------- +# The base image (node:20-alpine) has no entries for *.sami. We must inject +# them via --add-host so health checks inside the container can resolve LAN +# and Tailscale IPs to the right destinations. +# +# IMPORTANT: Do NOT add `git.sami:100.81.59.99` (DNS3). DNS3 does not serve +# HTTPS on 443 — it only serves Gitea on :3030. Setting git.sami → DNS3 in +# the container would make health checks bypass Caddy and hit a closed port. +# Let Caddy (on DNS2:443) handle git.sami and route to DNS3:3030 internally. +# +# Layout: +# dns3.sami / gitea → DNS3 (Tailscale IP, used by tools inside the container +# that need to talk to Gitea directly, e.g. backups) +# dns3-wan.sami → DNS3 Contabo WAN fallback +# dns2.sami → DNS2 (this host) — for cross-service references +# dns1.sami → DNS1 (SAMI-CLOUD-U32) +# dc-contabo-de → DashCaddy Contabo test instance +# git.dashcaddy.net → DashCaddy upstream git +# ca.sami → local CA (DN2 + DN3 both have their own) +ADD_HOST_FLAGS=( + --add-host=dns3.sami:100.81.59.99 + --add-host=gitea:100.81.59.99 + --add-host=dns3-wan.sami:74.208.167.19 + --add-host=dns2.sami:100.121.150.22 + --add-host=dns1.sami:100.71.97.12 + --add-host=dc-contabo-de:100.98.123.59 + --add-host=git.dashcaddy.net:100.98.123.59 + --add-host=ca.sami:127.0.0.1 +) + # Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist) if docker ps -a --format "{{.Names}}" | grep -q "^${CONTAINER_NAME}$"; then echo "[start.sh] Recreating container to apply correct env vars..." @@ -26,6 +56,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \ --add-host=get2.dashcaddy.net:194.233.88.206 \ --dns ${DNS_PRIMARY} \ --dns ${DNS_FALLBACK} \ + "${ADD_HOST_FLAGS[@]}" \ -p 127.0.0.1:3001:3001 \ -v ${DATA_DIR}:/app/data \ -v ${BACKUPS_DIR}:/app/backups \ @@ -48,4 +79,4 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \ -e ASSETS_DIR=/app/assets \ -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \ -e DASHCADDY_UPDATE_ENABLED=false \ - ${IMAGE} + ${IMAGE} \ No newline at end of file