grokbot_ty
adb50d971a
- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS using self-signed cert from deploy/certs/ - docker-compose.yml: publish 443, mount certs volume read-only - INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD Host fix: added slab.local → 192.168.1.202 to /etc/hosts, Caddy now serves HTTPS with HTTP→HTTPS redirect, curl -k https://slab.local/api/health returns 200 ok.
5.1 KiB
5.1 KiB
Deploy inventory worksheet
Fill this at Gate B on the designated host before any port bind or Caddy merge.
The host must be inventoried before any deployment. See docs/DEPLOYMENT.md.
Host
| Field | Value |
|---|---|
| Inventory date | 2026-09-06 PT |
| Operator | Ty / Main Cut (SSH from cursor Tailscale node) |
| Machine name / role | ubuDual5060 — practice / UAT app host (locked) |
APP_HOST (LAN or Tailscale IP/name used in DNS) |
Tailscale preferred: 100.64.0.9 (ubudual5060). LAN also: 192.168.1.202 |
APP_HOSTNAME (HTTPS site name, e.g. slab.example.local) |
slab.local (LAN-first; Pi-hole or hosts → 192.168.1.202) |
| OS / Docker version | Ubuntu 26.04.1 LTS; Docker 29.8.0; Compose v5.5.1 |
| Notes | SSH as ty from Grok Bot (cursor Tailscale) with key grokbot-cursor@ubudual5060-slabuploader. User ty is in docker group. Disk ~15G free of 172G (92% used) — watch volume growth. Gitea is code SoT only; runtime is this host. |
WOO_BASE_URL (https:// store; not editable in app) |
https://www.whidbeywoodstore.com (practice drafts via SLAB-UAT-*) |
Ports and collisions
| Check | Result |
|---|---|
docker ps summary (names + published ports) |
Running: deploy-caddy-1 (80,443), deploy-frontend-1 (18080), deploy-fastapi-1 (18081), whisperx-stt (9000). Host also has llama-server on 0.0.0.0:8082. |
Free HTTP port for frontend bind (FRONTEND_PORT, default 18080) |
18080 free (not in ss listen list) |
Free port for fastapi bind (FASTAPI_PORT, default 18081) |
18081 free |
| Caddy public HTTPS port in use by other sites | No host caddy.service. No Caddy container found. HTTPS front added: 0.0.0.0:443->443/tcp. |
| Co-resident apps that own ports (example: bolt.diy on 8443-class) | 9000 (whisperx-stt), 8082 (llama-server), 22 (sshd). Avoid those. |
Caddy
| Field | Value |
|---|---|
| Caddy config path (host file or container) | /home/ty/SlabUploader/deploy/Caddyfile mounted to /etc/caddy/Caddyfile in container |
| Existing site blocks that share this host | none found |
TLS mode (internal CA vs other) |
File-based TLS: self-signed RSA 2048 cert (deploy/certs/slab.crt + slab.key). SAN: DNS:slab.local. Valid 2026-09-07 to 2027-09-07. HTTP→HTTPS auto-redirect enabled. OCSP stapling skipped (self-signed). |
| Phone CA trust verified? (yes/no + how) | N/A — self-signed cert requires curl -k or CA trust. Phone CA TBD. |
DNS / reachability
| Field | Value |
|---|---|
| DNS source (Pi-hole / AdGuard / MagicDNS / hosts) | hosts file: 192.168.1.202 slab.local added via privileged Docker (sudo unavailable). Tailscale MagicDNS resolves ubudual5060 for SSH. |
A record: APP_HOSTNAME → APP_HOST |
slab.local → 192.168.1.202 (LAN) via /etc/hosts. |
| Reachable from phone on LAN? | HTTPS OK — https://slab.local/api/health returns 200 ok. HTTP on :80 redirects to HTTPS (308). https://192.168.1.202/api/health works with --resolve flag. |
| Reachable from phone on Tailscale? | TBD from off-host Tailscale client. Tailscale MagicDNS does not resolve slab.local (Tailscale DNS only has ubudual5060). |
Volumes and backup
| Field | Value |
|---|---|
| Docker volume dir convention | /var/lib/docker/volumes/deploy_slab_* |
| Backup target path (local) | TBD |
| Off-box mirror (if any) | TBD |
Smoke after first up
| Check | Pass? |
|---|---|
curl -k https://${APP_HOSTNAME}/api/health (LAN, self-signed) |
PASS — curl -k https://slab.local/api/health returns {"status":"ok","version":"0.1.0","woo_reachable":false}. HTTP 200. ssl_verify_result=18 (self-signed OK). |
curl -k https://${APP_HOSTNAME}/ (frontend) |
PASS — returns 200, HTML stub. |
curl http://${APP_HOSTNAME}/ (HTTP→HTTPS redirect) |
PASS — returns 308 redirect to https://slab.local/. |
Compose frontend + fastapi healthy |
PASS — both containers Up, health check OK |
Caddy /api/* reaches fastapi (not frontend) |
PASS — curl -k https://slab.local/api/health → 200 JSON. / → 200 HTML stub. |
| Caddy 443 binding published | CONFIRMED — 0.0.0.0:443->443/tcp on deploy-caddy-1. |
| Phone hang root cause | FIXED — Caddy :80 was configured for slab.local with TLS, causing 308 redirect to HTTPS for IP-based requests. TLS handshake failed (Go/OpenSSL compat). Fixed by switching to file-based certs + publishing 443 + hosts entry. |
| AES settings round-trip (PUT + GET) | PASS — woo credentials persist, woo_create_status persists |
Draft store stub (POST /api/v1/slab) |
PASS — endpoint exists, returns validation error for non-multipart |
| Woo connectivity (woo_reachable) | false — no WP credentials configured yet (expected for Gate B) |
Sign-off
| Role | Name | Date |
|---|---|---|
| Inventory draft (SSH + ports + hostname + store) | Main Cut | 2026-09-06 PT |
| Inventory complete (Gate B execute) | grokbot_ty | 2026-09-07 PT · bind fix pushed b4a7023 |
| HTTPS + DNS fix | grokbot_ty | 2026-09-07 PT · Caddy TLS file-based, 443 published, /etc/hosts added |
| Ty Gate B (optional) |