feature(msc): adds subdomain, certificate and docker backend #2

Merged

Luke-Watts merged 1 commit from feature/adds-msc-subdomain into main

2026-06-21 21:27:31 +02:00

Luke-Watts commented

2026-06-21 21:18:48 +02:00

Owner

Provisioning a new msc subdomain surfaced three pre-existing bugs in the shared Apache cert pipeline that needed fixing before msc (or future subdomains) could be added safely:

Apache was serving a cert that nothing renews. The compose file mounted ./certbot/conf (a project-relative path) into /etc/letsencrypt, while the host's certbot (run via Ansible) writes to the real system /etc/letsencrypt. Apache had been serving a separate, orphaned cert lineage (cloud.makerspaceleiden.nl-0001) that certbot's renewal job has no knowledge of — it would have expired silently with no renewal ever reaching it. Mounting the real host path fixes this and makes msc's upcoming cert land in the same, actually-renewed location.
ACME HTTP-01 validation was unroutable through the reverse proxy. ProxyPass / forwards everything to the backend container by default, including /.well-known/acme-challenge/, so Let's Encrypt's validation requests were hitting the app container instead of the static challenge file and failing with 404. Explicit ProxyPass /.well-known ! exclusions let the Alias-served static files take precedence.
Logs were silently useless. Vhosts referenced a combined CustomLog format that was never defined in httpd.conf (only common was), so every log line printed the literal word "combined" instead of real request data — made all of the above much harder to diagnose than necessary.

With these fixed, the new msc role follows the same now-correct pattern as cloud: HTTP vhost serves the ACME challenge and proxies to msc-helloworld until a cert exists, then an HTTPS vhost takes over.

Provisioning a new msc subdomain surfaced three pre-existing bugs in the shared Apache cert pipeline that needed fixing before msc (or future subdomains) could be added safely: 1. Apache was serving a cert that nothing renews. The compose file mounted ./certbot/conf (a project-relative path) into /etc/letsencrypt, while the host's certbot (run via Ansible) writes to the real system /etc/letsencrypt. Apache had been serving a separate, orphaned cert lineage (cloud.makerspaceleiden.nl-0001) that certbot's renewal job has no knowledge of — it would have expired silently with no renewal ever reaching it. Mounting the real host path fixes this and makes msc's upcoming cert land in the same, actually-renewed location. 2. ACME HTTP-01 validation was unroutable through the reverse proxy. ProxyPass / forwards everything to the backend container by default, including /.well-known/acme-challenge/, so Let's Encrypt's validation requests were hitting the app container instead of the static challenge file and failing with 404. Explicit ProxyPass /.well-known ! exclusions let the Alias-served static files take precedence. 3. Logs were silently useless. Vhosts referenced a combined CustomLog format that was never defined in httpd.conf (only common was), so every log line printed the literal word "combined" instead of real request data — made all of the above much harder to diagnose than necessary. With these fixed, the new msc role follows the same now-correct pattern as cloud: HTTP vhost serves the ACME challenge and proxies to msc-helloworld until a cert exists, then an HTTPS vhost takes over.

Luke-Watts added 1 commit

2026-06-21 21:18:49 +02:00