From 1f5f1fede8885464232515d5c1ec0da4a2f29d21 Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Sun, 9 Aug 2026 22:35:47 -0400 Subject: [PATCH] Serve the frontend on the bare domain instead of app. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only drb.cusano.net and api.drb.cusano.net have public A records, so the app. vhost had no cert to present and the bare domain — the record that actually exists — matched no site at all, producing ERR_SSL_PROTOCOL_ERROR in the browser. Co-Authored-By: Claude Opus 5 --- infra/ansible/roles/deploy/templates/Caddyfile.j2 | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/infra/ansible/roles/deploy/templates/Caddyfile.j2 b/infra/ansible/roles/deploy/templates/Caddyfile.j2 index d3c5be7..31fa740 100644 --- a/infra/ansible/roles/deploy/templates/Caddyfile.j2 +++ b/infra/ansible/roles/deploy/templates/Caddyfile.j2 @@ -1,4 +1,4 @@ -# Managed by Ansible — do not edit manually on the server. +# Managed by Ansible — do not edit manually. api.{{ domain }} { reverse_proxy localhost:8888 { @@ -6,7 +6,12 @@ api.{{ domain }} { } } -app.{{ domain }} { +# Frontend is served on the bare domain, not app.{{ domain }}: only drb and api +# have public DNS records. A vhost for a name with no A record still starts, +# but Caddy retries ACME against it forever and logs a failure each time. +# To move it to app.{{ domain }}, create the A record first, then change this +# line — the reverse_proxy target stays the same either way. +{{ domain }} { reverse_proxy localhost:3000 { header_up X-Forwarded-For {remote_host} }