claude-botandClaude Opus 4.8
3984cd0d14
Adds proxy-2.renner.uno (netcup, Arch) as a second proxy-only cluster member so proxy.renner.uno can move off netbird.renner.uno entirely. The controller host shared one IP and port with the reverse proxy, separated only by TLS SNI, which made destination NAT for LAN hairpin impossible without also capturing NetBird control-plane traffic. netbird-proxy listens on :443 only (NB_PROXY_ADDRESS=:443) and has no HTTP listener, so once proxy.renner.uno stopped resolving to the controller host, port 80 went unanswered for every off-LAN client. Adds a minimal nginx redirector publishing :80 on every member to restore the 301. Deploying that sidecar exposed two defects in the role: - Any docker-compose.yml change notified the force-recreate handler, rebuilding the proxy container even for edits that do not touch the proxy service. `docker compose up -d` already recreates only changed services, so the notify is dropped there; proxy.env keeps it because compose cannot detect env_file content changes. - The play restarted every cluster member in parallel, taking the whole proxy cluster down at once. Now serial: 1. Verified: both members serve :443 (200) and :80 (301); a repeat run reports changed=0 on both with no handler firing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>