Adds proxy-2.renner.uno (netcup, Arch) as a second proxy-only cluster member
so proxy.renner.uno can move off netbird.renner.uno entirely. The controller
host shared one IP and port with the reverse proxy, separated only by TLS SNI,
which made destination NAT for LAN hairpin impossible without also capturing
NetBird control-plane traffic.
netbird-proxy listens on :443 only (NB_PROXY_ADDRESS=:443) and has no HTTP
listener, so once proxy.renner.uno stopped resolving to the controller host,
port 80 went unanswered for every off-LAN client. Adds a minimal nginx
redirector publishing :80 on every member to restore the 301.
Deploying that sidecar exposed two defects in the role:
- Any docker-compose.yml change notified the force-recreate handler, rebuilding
the proxy container even for edits that do not touch the proxy service.
`docker compose up -d` already recreates only changed services, so the notify
is dropped there; proxy.env keeps it because compose cannot detect env_file
content changes.
- The play restarted every cluster member in parallel, taking the whole proxy
cluster down at once. Now serial: 1.
Verified: both members serve :443 (200) and :80 (301); a repeat run reports
changed=0 on both with no handler firing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
claude-botandClaude Opus 4.8
3984cd0d14