jacobh2/kvitt
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Pi stack behind Nginx Proxy Manager: remove Caddy and cert-sync (D-120)

Browse Source 
The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST,
NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not
icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only
fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant
SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080,
then through NPM. The cert-sync image leaves the workflow and build-images.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
This commit is contained in:
Jacob Hagstedt
2026-10-19 19:49:56 +02:00
parent 4f69ae010e
commit d05f13a080
12 changed files with 100 additions and 302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/pi/lib.sh
+23 -6
View File
@@ -4,8 +4,10 @@
# shellcheck disable=SC2034 # variables are used by the scripts that source this file
KVITT_DIR=${KVITT_DIR:-/opt/kvitt}
PUBLIC_HOST=icehack.asuscomm.com
PUBLIC_PORT=8443
# The server's port, published on the Pi's LAN interfaces; Nginx Proxy Manager forwards to it (D-120).
SERVER_URL=http://localhost:8080
# Nginx Proxy Manager's HTTPS port on the Home Assistant Pi (the router forwards external 8443 to it, D-120).
NPM_HTTPS_PORT=443
say() { printf '%s\n' "$*"; }
die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
@@ -56,14 +58,29 @@ wait_healthy() {
done
}
# GET /health through Caddy on this Pi, with the real certificate check (no -k): proves TLS and the proxy path.
# GET /health from the server's published port on this Pi.
print_health() {
local out
if out=$(curl -fsS --max-time 15 --resolve "$PUBLIC_HOST:$PUBLIC_PORT:127.0.0.1" "https://$PUBLIC_HOST:$PUBLIC_PORT/health" 2>&1); then
say "GET https://$PUBLIC_HOST:$PUBLIC_PORT/health (via this Pi): $out"
if out=$(curl -fsS --max-time 15 "$SERVER_URL/health" 2>&1); then
say "GET $SERVER_URL/health: $out"
return 0
fi
say "GET https://$PUBLIC_HOST:$PUBLIC_PORT/health (via this Pi) failed: $out"
say "GET $SERVER_URL/health failed: $out"
return 1
}
# GET /health through Nginx Proxy Manager on the Home Assistant Pi (HA_HOST in .env) for KVITT_PUBLIC_HOST, with
# the real certificate check (no -k): proves NPM's proxy host, its certificate and the LAN path to this Pi's port
# 8080. The router forward is not on this path.
print_proxy_health() {
local out ha_host host
ha_host=$(env_value HA_HOST)
host=$(env_value KVITT_PUBLIC_HOST)
if out=$(curl -fsS --max-time 15 --resolve "$host:$NPM_HTTPS_PORT:$ha_host" "https://$host:$NPM_HTTPS_PORT/health" 2>&1); then
say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host): $out"
return 0
fi
say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host) failed: $out"
return 1
}