mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 11:22:31 +00:00
kevinveenbirkenbachandClaude Opus 5
3309038b56
Two defects, the second only visible once the first was gone. The hub answered every proxied request with HTTP 400. In swarm it joins the proxy's own overlay, so the forwarded request arrives from that network and not from the hub's, while `trusted_proxies` listed only the hub's own subnet. The container log named the address it rejected, and the two networks resolve to 192.168.107.0/24 for the proxy against 192.168.79.0/24 for the hub. Compose has no such split, which is why this never surfaced there. Use the project-wide trusted-proxy CIDRs instead, the same list three other roles already consume. With the proxy trusted the failure moved to HTTP 502: the backend was crash-looping. Home Assistant guards its config directory with a PID lock, so the second and third replica on the shared volume abort with "Another Home Assistant instance is already running" and never come up. The service sat at 2/3 with `task: non-zero exit (1)` cycling over all three nodes. Upstream supports no multi-instance mode, so the hub is pinned to a single replica like xwiki and jellyfin before it. Verified by a full swarm run: deploy, e2e and the drain-and-reschedule step all green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9 lines
146 B
Django/Jinja
9 lines
146 B
Django/Jinja
default_config:
|
|
|
|
http:
|
|
use_x_forwarded_for: true
|
|
trusted_proxies:
|
|
{% for cidr in NETWORK_TRUSTED_PROXY_CIDRS %}
|
|
- {{ cidr }}
|
|
{% endfor %}
|