From a30cb4a30e46f421f79903cc9a199c674a7286ed Mon Sep 17 00:00:00 2001 From: Barely Removable Date: Wed, 26 Aug 2026 13:02:52 -0700 Subject: [PATCH] Document the reverse proxy setup and container-restart gotcha Records what wasn't discoverable from the repo alone after today's outage: Cox blocks inbound port 80 so certs must use DNS-01, the apex proxy host's destination has drifted before, the NPM UI can show a cert as valid/in-use while nginx presents none on disk, and restarting via the Unraid Docker UI throws "No such container" after every deploy because Compose gives the container a fresh ID each time. Co-Authored-By: Claude Sonnet 5 --- CLAUDE.md | 44 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 6793b43..43fb71a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -82,9 +82,51 @@ three projects on this box — see `card-grader`'s `CLAUDE.md` for the full pipeline mechanics. Push to `main` on the `forgejo` remote (`https://git.hippofam.com/ninja_hippo/arr-summary.git`) triggers `.forgejo/workflows/deploy.yml`, which syncs into -`/mnt/user/appdata/greendale` (excluding `.git`, `.env`) and runs +`/mnt/user/appdata/greendale` (excluding `.git`, `.env`, `data/`) and runs `docker compose up -d --build`. +**Restarting the container manually: use Compose, not the Unraid Docker +UI.** Every deploy recreates the container with a new Docker ID (same +name, `arr-summary`). Unraid's Docker tab caches the old ID, so hitting +Restart there after a deploy throws "No such container" — harmless, but +confusing. From the Unraid terminal: +```bash +cd /mnt/user/appdata/greendale && docker compose restart +``` +`docker compose up -d --force-recreate` for a guaranteed-clean recreate; +`docker ps --filter name=arr-summary` to check real state regardless of +what the Unraid UI shows. + +## Reverse proxy (Nginx Proxy Manager) + +Two NPM proxy hosts front this app and `git.hippofam.com`, both using +Let's Encrypt certs issued via **DNS-01 through Porkbun** — required, +not optional: **Cox blocks inbound port 80** on this connection, so +HTTP-01 challenges (and plain `http://` requests generally) can never +work here. `http://hippofam.com` will always time out from outside the +LAN; only `https://` resolves. Both proxy hosts have Force SSL on. + +`hippofam.com` → `http://192.168.86.33:5055` (the Unraid box, this +container's port). Verify the destination IP/port here before assuming +an outage is DNS or app-level — it has drifted to the wrong host before. + +On 2026-08-26 the apex host's own cert (issued Aug 2025) went dark: NPM's +UI still showed it "In Use" with a valid, unexpired date, but nginx +presented no certificate at all for `hippofam.com` (TLS alert 112, +"unrecognized name") — the on-disk cert files had rotted independently +of the DB record NPM's UI reads from. `git.hippofam.com`, on a newer +cert from the same account, was unaffected. Fixed by pointing the proxy +host at the `*.hippofam.com` + `hippofam.com` wildcard cert already +issued and sitting unused, which forced NPM to regenerate the nginx +config with known-good cert files. If `hippofam.com` ever throws a TLS +handshake error again with NPM's UI reporting all green, suspect this +same on-disk/DB drift before anything else — check with: +```bash +openssl s_client -connect :443 -servername hippofam.com