The Nix cache's setup steps pointed at a home-lab proxy that no longer exists #316
Assignees
FernandoMX
FlipperDan
HitFrostbite
enricobuehler (Enrico Bühler)
kszlim
luxus
nannku
neoney
sassycrown
Clear assignees
FernandoMX
FlipperDan
HitFrostbite
enricobuehler (Enrico Bühler)
kszlim
luxus
nannku
neoney
sassycrown
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unom/punktfunk#316
Reference in New Issue
Block a user
Follow-up to #313. That PR's bring-up instructions were copied from
packaging/flatpak/README.md, which still describes an edge proxy onhome-reverse-proxy-1forwarding to192.168.50.50. That topology is gone, so anyone following those steps would have configured a proxy that isn't there.packaging/winget/server/compose.production.yml— the newest of the three service definitions, and the only one written since the move — says so outright:Confirmed independently:
flatpak.unom.ioresolves to167.233.145.172, which is unom-1 itself.What changes
The steps now match how
docsandwingetwere actually stood up:unom.ioCloudflare zone, DNS-only, straight at the hcloud box.unom/infracaddy/Caddyfile, proxying tolocalhost:3250— not192.168.50.50, and not hand-edited on the box.~/caddy/Caddyfilethere looks like the config but is an rsynced copy with no.gitto warn you; a vhost added only on the box lasts until the next deploy. That's how the winget source vanished on 2026-07-26, so it's called out here too.caddy_target_ports+ terraform is dropped. It was the home-lab firewall allowlist; winget's setup, written post-move, has no such step.:80to https, including names it has never heard of, so probing port 80 proves nothing — check the certificate by SNI.scripts/setup-nix-cache.shAn interactive walkthrough of the five steps (built from the
/wizardtemplate). It opens each page, says exactly what to click, and verifies each stage before moving on — the failure signatures are easy to confuse: a TLS handshake failure means the vhost is missing, a 502 means the container is down, and a 404 means the cache is healthy and empty.It also closes a loop #313 left open. It generates the signing key locally (a local
nix, or thenixos/niximage) and writes the public half straight into the two docs that carried a<fill-in>placeholder — nobody waits an hour for the first publish to print a value we can derive up front. The secret half is shown once for pasting into Gitea and never touches disk. Re-running detects an installed key and refuses to silently replace it, since that would invalidate every signature already published.Verified
shellcheckclean,bash -nclean, 5stagecalls againstTOTAL_STAGES=5.nix key generate-secretproduces thename:base64line, andconvert-secret-to-publicround-trips it./, so the sed uses|as its delimiter.Not touched: the stale comments in the flatpak and docs compose files themselves. The winget note already records the drift, and rewriting those is a separate cleanup.
The bring-up instructions were copied from packaging/flatpak/README.md, which still describes an edge proxy on `home-reverse-proxy-1` forwarding to 192.168.50.50. That home-lab topology is gone. packaging/winget/server/ compose.production.yml — the newest of the three and the only one written since the move — says so outright: "the sibling docs/flatpak compose files still carry stale comments … the public hostnames resolve straight to the hcloud box and are served by Caddy there — no local proxy is involved." flatpak.unom.io resolves to 167.233.145.172, which is unom-1 itself, confirming it. So the steps now match how docs and winget were actually stood up: * DNS in the unom.io Cloudflare zone, DNS-only, straight at the hcloud box. * The vhost in unom/infra `caddy/Caddyfile`, proxying to localhost:3250 — NOT 192.168.50.50, and NOT hand-edited on the box. ~/caddy/Caddyfile there looks like the config but is an rsynced copy with no .git to warn you; a vhost added only on the box lasts until the next deploy. That is how the winget source vanished on 2026-07-26, and it is now called out here too. * `caddy_target_ports` + terraform is dropped. It was the home-lab firewall allowlist; winget's setup, written post-move, has no such step. Also adds the SNI diagnostic winget's README hard-won: Caddy 308s every Host on :80 to https, including names it has never heard of, so probing port 80 proves nothing — check the certificate by SNI instead. scripts/setup-nix-cache.sh walks the five steps interactively (built from the /wizard template): it opens each page, says exactly what to click, and verifies each stage before moving on, because the failure signatures are easy to confuse — a TLS handshake failure means the vhost is missing, a 502 means the container is down, and a 404 means the cache is healthy and empty. It also closes the loop the first version left open: it generates the signing key locally (a local nix, or the nixos/nix image — MEASURED: both produce the `name:base64` line, and convert-secret-to-public round-trips), then writes the PUBLIC half straight into the two docs that carried a `<fill-in>` placeholder. Nobody has to wait an hour for the first publish to print a value we can derive up front. The secret half is shown once for pasting into Gitea and never touches disk. Re-running detects an installed key and refuses to silently replace it, since that would invalidate every signature already published. Verified: shellcheck clean, `bash -n` clean, 5 stages against TOTAL_STAGES=5, and the doc substitution tested against a real generated key — public keys are base64 and contain `/`, so the sed uses `|` as its delimiter.