Serve the frontend on the bare domain instead of app.<domain>

Only drb.cusano.net and api.drb.cusano.net have public A records, so the
app.<domain> vhost had no cert to present and the bare domain — the record
that actually exists — matched no site at all, producing
ERR_SSL_PROTOCOL_ERROR in the browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -12,9 +12,14 @@ services:
     restart: always
     ports: !reset []   # Remove the dev 1883:1883 mapping — internal only
 
+  # !override, not a plain list: compose MERGES `ports` by appending, so a plain
+  # list leaves the base file's "8888:8000" in place alongside this one. The
+  # container then tries to bind 8888 twice — 0.0.0.0 and 127.0.0.1 — and the
+  # second bind fails with "address already in use". It also silently defeated
+  # the whole point of this override, publishing the port on every interface.
   c2-core:
     restart: always
-    ports:
+    ports: !override
       - "127.0.0.1:8888:8000"  # Caddy proxies, not exposed publicly
 
   discord-bot:
@@ -22,5 +27,5 @@ services:
 
   frontend:
     restart: always
-    ports:
+    ports: !override
       - "127.0.0.1:3000:3000"  # Caddy proxies, not exposed publicly

infra/ansible/roles/deploy/handlers/main.yml

@@ -0,0 +1,13 @@
+---
+# The "Deploy Caddyfile" task notifies this. Without this file the play aborts
+# with "The requested handler 'Reload Caddy' was not found" — notify does not
+# tolerate a missing handler.
+#
+# reloaded, not restarted: caddy reload swaps config with zero downtime and
+# keeps existing TLS certs/connections; a restart drops every in-flight request.
+
+- name: Reload Caddy
+  ansible.builtin.systemd_service:
+    name: caddy
+    state: reloaded
+    enabled: true

infra/ansible/roles/deploy/tasks/main.yml

@@ -2,12 +2,19 @@
 # First-time setup: clone repo, write secrets, pull pre-built images and start stack.
 # Images are built and pushed by Gitea CI — this role never builds on the VM.
 
-- name: Clone repo (skipped if already present)
+# update: true (was false) — with update disabled, every re-run of this playbook
+# redeployed the code that happened to be on the VM at first clone, so any fix
+# pushed to main was invisible here and the only way to ship one was CI or a
+# manual pull. force: true discards local edits made on the VM; the templated
+# .env files and Caddyfile live outside git tracking, so nothing generated by
+# this role is at risk.
+- name: Clone or update repo
   git:
     repo: "{{ repo_url }}"
     dest: "{{ app_dir }}"
     version: main
-    update: false
+    update: true
+    force: true
   become: false
 
 - name: Set ownership of app directory

infra/ansible/roles/deploy/templates/Caddyfile.j2

@@ -1,4 +1,4 @@
-# Managed by Ansible — do not edit manually on the server.
+# Managed by Ansible — do not edit manually.
 
 api.{{ domain }} {
   reverse_proxy localhost:8888 {
@@ -6,7 +6,12 @@ api.{{ domain }} {
   }
 }
 
-app.{{ domain }} {
+# Frontend is served on the bare domain, not app.{{ domain }}: only drb and api
+# have public DNS records. A vhost for a name with no A record still starts,
+# but Caddy retries ACME against it forever and logs a failure each time.
+# To move it to app.{{ domain }}, create the A record first, then change this
+# line — the reverse_proxy target stays the same either way.
+{{ domain }} {
   reverse_proxy localhost:3000 {
     header_up X-Forwarded-For {remote_host}
   }

infra/ansible/roles/deploy/templates/root.env.j2

@@ -1,10 +1,19 @@
 # Top-level docker-compose environment — MQTT credentials and registry prefix.
 # Managed by Ansible. Do not edit manually.
+#
+# The passwords are $-escaped ($ -> $$). Compose INTERPOLATES this file, so a
+# raw "$fP" in a password is read as the variable $fP, warned about, and
+# replaced with an empty string. The env_file templates (c2-core.env.j2 etc.)
+# are NOT interpolated, so they keep the literal value — which means an
+# unescaped $ here silently gives mosquitto and c2-core two different
+# passwords and MQTT auth fails. Compose collapses $$ back to a single $, so
+# both sides end up with the real password.
+# Do not add the same escaping to the env_file templates; it would be literal.
 
 MQTT_C2_USER={{ vault_mqtt_c2_user }}
-MQTT_C2_PASS={{ vault_mqtt_c2_pass }}
+MQTT_C2_PASS={{ vault_mqtt_c2_pass | replace('$', '$$') }}
 MQTT_NODE_USER={{ vault_mqtt_node_user }}
-MQTT_NODE_PASS={{ vault_mqtt_node_pass }}
+MQTT_NODE_PASS={{ vault_mqtt_node_pass | replace('$', '$$') }}
 
 # Container registry prefix — docker compose uses this for image: ${REGISTRY}/name:latest
 REGISTRY={{ vault_registry }}

infra/ansible/site.yml

@@ -36,16 +36,33 @@
         path: /swapfile
         mode: "0600"
 
+    # mkswap refuses to touch a file that is already active as swap, so a
+    # re-run would fail here without this guard. The swap file survives
+    # reboots via the fstab entry below, so on any second run it IS active.
+    - name: Check whether the swap file is already active
+      command: swapon --show=NAME --noheadings
+      register: _active_swaps
+      changed_when: false
+      failed_when: false
+
     - name: Format swap file
       command: mkswap /swapfile
+      when: "'/swapfile' not in _active_swaps.stdout"
       register: _mkswap
       changed_when: _mkswap.rc == 0
 
+    # Guarded by the same check as mkswap above. The stderr test alone was not
+    # enough: an already-active swap file reports "Device or resource busy",
+    # not "already", so the original failed_when never matched it.
     - name: Enable swap
       command: swapon /swapfile
+      when: "'/swapfile' not in _active_swaps.stdout"
       register: _swapon
-      failed_when: _swapon.rc != 0 and 'already' not in _swapon.stderr
-      changed_when: _swapon.rc == 0
+      failed_when: >
+        _swapon.rc is defined and _swapon.rc != 0
+        and 'already' not in _swapon.stderr
+        and 'busy' not in _swapon.stderr
+      changed_when: _swapon.rc is defined and _swapon.rc == 0
 
     - name: Persist swap in fstab
       lineinfile:

infra/ansible/vault.yml.example

@@ -4,6 +4,13 @@
 # Edit later with:
 #   ansible-vault edit vault.yml
 
+# DO NOT put a literal "$" in any value here. Docker compose interpolates the
+# top-level .env, and depending on version it also interpolates env_file, so a
+# password like "aB$fPx" is read as the variable $fPx and silently replaced
+# with an empty string — on one side of the connection but not the other.
+# That produced "MQTT connect refused: Not authorized" with no obvious cause.
+# Generate with: openssl rand -hex 32  (hex output has no shell metacharacters)
+
 # ── MQTT ─────────────────────────────────────────────────────────────────────
 vault_mqtt_c2_user: drb-c2-core
 vault_mqtt_c2_pass: "CHANGE_ME"
@@ -22,7 +29,14 @@ vault_firestore_database: "c2-server"
 # ── Gitea Container Registry ──────────────────────────────────────────────────
 vault_registry_host: "git.vpn.cusano.net"
 vault_registry_user: "logan"
-vault_registry_token: ""                                   # Gitea access token with package:write scope
+vault_registry_token: ""                                   # Gitea access token, READ-ONLY package scope.
+                                                           # The VM only pulls (roles/deploy/tasks/main.yml:62-72);
+                                                           # nothing here pushes. Pushing is CI's job and uses a
+                                                           # separate write-scoped token (BUILD_TOKEN in Gitea
+                                                           # repo secrets). Keep them separate: this token sits on
+                                                           # an internet-facing VM, and a write-scoped one there
+                                                           # would let an attacker publish a poisoned image that
+                                                           # every future deploy and edge node would install.
 vault_registry: "git.vpn.cusano.net/logan"                # full image prefix
 
 # ── Discord Bot ───────────────────────────────────────────────────────────────