| author |  clover caruso <git@paperclover.net> 2026-06-11 01:12:50-07:00 |
| committer | clover caruso <git@paperclover.net> 2026-06-11 01:38:21-07:00 |
| log | bda913a0867d4195cfd6d2b78d1644a6c3f16f47 |
| tree | 689bb9cea06efbc1ab1dbf5171fdd9eeeb142b85 |
| parent | 918ed85280c0631abaaa079cc74e341b5ea8c089 |
| signature |  Signed by SSH key SHA256:xbd+BjjhyBfwk7GVoURf9Yx0gzDerHbvYv7SddNWmAs |
fix: resolve auth.<domain> via docker dns alias on caddy
forward-auth and forgejo baked caddy's container ip for
auth.<domain> into /etc/hosts at boot; whenever caddy was recreated
its ip changed and every fresh oidc token exchange failed with
connection refused (existing sessions kept working, so it broke
silently — surfaced tonight as a 500 on the oauth2-proxy callback).
a network alias on the caddy service keeps docker dns current
instead, and both entrypoint hacks are gone.3 files changed, 6 insertions(+), 4 deletions(-)
compose.yaml+6
| ... | @@ -7,6 +7,12 @@ services: | ... | @@ -7,6 +7,12 @@ services: |
| 7 | - 80:80 | 7 | - 80:80 |
| 8 | - 443:443 | 8 | - 443:443 |
| 9 | restart: unless-stopped | 9 | restart: unless-stopped |
| 10 | networks: | ||
| 11 | default: | ||
| 12 | aliases: | ||
| 13 | # lets containers reach keycloak through caddy at its public name | ||
| 14 | # without the stale-/etc/hosts-entry trick (the ip changes on recreate) | ||
| 15 | - "auth.${HOME_DOMAIN}" | ||
| 10 | user: "$USER_ID:$GROUP_ID" | 16 | user: "$USER_ID:$GROUP_ID" |
| 11 | volumes: | 17 | volumes: |
| 12 | - "./config:/etc/caddy:ro" | 18 | - "./config:/etc/caddy:ro" |
config/forgejo/init/entry.sh-2
| ... | @@ -5,8 +5,6 @@ mkdir -p /custom/conf | ... | @@ -5,8 +5,6 @@ mkdir -p /custom/conf |
| 5 | envsubst </custom/init/app.ini >/custom/conf/app.ini | 5 | envsubst </custom/init/app.ini >/custom/conf/app.ini |
| 6 | chmod 444 /custom/conf/app.ini | 6 | chmod 444 /custom/conf/app.ini |
| 7 | 7 | ||
| 8 | CADDY_IP="$(getent hosts caddy | awk '{print $1}')" | ||
| 9 | echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts | ||
| 10 | 8 | ||
| 11 | /usr/bin/entrypoint echo meow >/dev/null | 9 | /usr/bin/entrypoint echo meow >/dev/null |
| 12 | su git -c "bash /custom/init/config.sh" | 10 | su git -c "bash /custom/init/config.sh" |
config/keycloak/forward-auth/entry.sh-2
| ... | @@ -1,8 +1,6 @@ | ... | @@ -1,8 +1,6 @@ |
| 1 | #!/bin/sh | 1 | #!/bin/sh |
| 2 | set -e | 2 | set -e |
| 3 | 3 | ||
| 4 | CADDY_IP="$(nslookup caddy | awk '/^Address: / { print $2 }')" | ||
| 5 | echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts | ||
| 6 | rm -f /etc/ssl/certs/caddy.crt | 4 | rm -f /etc/ssl/certs/caddy.crt |
| 7 | ln -s /caddy/pki/authorities/root.crt /etc/ssl/certs/caddy.crt | 5 | ln -s /caddy/pki/authorities/root.crt /etc/ssl/certs/caddy.crt |
| 8 | 6 |