fix: deploy papercuts — marker-host ACME spam, .env.example footgun, INSTALL 404 - #200
Open
CallMeTechie wants to merge 1 commit into
Open
fix: deploy papercuts — marker-host ACME spam, .env.example footgun, INSTALL 404#200CallMeTechie wants to merge 1 commit into
CallMeTechie wants to merge 1 commit into
Conversation
…INSTALL 404
1. Ownership marker host (gc-owner.invalid, RFC 6761 reserved TLD) was a real
host matcher with no TLS policy → Caddy automatic_https issued a doomed
public ACME order, retried forever. Add srv0.automatic_https.skip so the
marker (which never serves) is excluded from cert management. Contract test
asserts the skip entry and that the marker is never an ACME subject.
2. .env.example shipped active GC_WG_POST_UP/POST_DOWN with hardcoded eth0 and
GC_NET_INTERFACE=eth0. A set POST_UP overrides the entrypoint's superior
auto-detected rules (scoped MASQUERADE + RELATED,ESTABLISHED + MSS clamp),
and eth0 is wrong on most Debian/KVM hosts. Blank them with guidance; mirror
GC_NET_INTERFACE in the stale deploy/ copy.
3. INSTALL.{md,de.md} told users to download/cp `.env.example`, but the release
asset is `default.env.example` (GitHub forbids a leading dot) → 404 / failed
cp. Point the download URLs, cp, and cross-references at default.env.example.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drei unabhängige Deploy-Stolpersteine, alle bei einer Frischinstallation auf einem fremden Server aufgefallen und gegen
masterverifiziert.1. 🔴 Echter Bug: Owner-Marker-Host landet bei öffentlichem ACME
Der Ownership-Marker
gc-owner.invalid(RFC 6761 reservierte.invalid-TLD) wird insrv0.routesals echter Host-Matcher angehängt (caddyConfig.js), aber nicht in die TLS-Automation-Subjects gegeben. Caddysautomatic_httpsversucht daraufhin eine öffentliche ACME-Order →Cannot issue for "gc-owner.invalid": Domain name does not end with a valid public suffix→ Endlos-Retry-Spam (Rate-Limit-Risiko gegen LE Prod+Staging).Fix:
srv0.automatic_https.skip: [MARKER_HOST]— der Marker serviert nie auf der Leitung und braucht kein Zertifikat.MARKER_HOSTauscaddyOwnerexportiert. Vertrags-Test prüft den Skip-Eintrag und dass der Marker nie ACME-Subject ist.2. 🟠
.env.example-Footgun gegen das eigene EntrypointDie ausgelieferte
.env.examplehatte aktiveGC_WG_POST_UP/POST_DOWNmit hartemeth0undGC_NET_INTERFACE=eth0. Ein gesetztesGC_WG_POST_UPüberschreibt die besseren Auto-Defaults des Entrypoints (scoped MASQUERADE +RELATED,ESTABLISHED+ TCP-MSS-Clamping);eth0ist auf den meisten Debian/KVM-Hosts falsch (ens18, …).Fix: Felder leeren + Hinweis-Kommentar (Entrypoint auto-detektiert).
GC_NET_INTERFACEauch in der veraltetendeploy/-Kopie angeglichen.3. 🟠 INSTALL-Doku 404 auf das Release-Asset
INSTALL.{md,de.md} ließen
.env.exampleherunterladen/kopieren, das Release-Asset heißt aberdefault.env.example(GitHub erlaubt keinen führenden Punkt → softprops benennt um). Wörtliches Befolgen → 404 bzw. fehlschlagendescp.Fix: Download-URLs,
cpund Querverweise aufdefault.env.example. Repo-interne Referenz (.env.exampleim Repository) bleibt korrekt.Tests
caddyConfig_contract16/0,caddyOwner+caddyTlsAutomation+portal_caddy_tls28/0 — lokal grün.Bewusst ausgelassen (geringer Wert / größerer Eingriff): wg0.conf-PostUp-Reset bei geleertem POST_UP, doppelte (identische) MASQUERADE-Regel, privates GHCR/npm-Token-Doku.
🤖 Generated with Claude Code