Connect to Postgres directly instead of via `sudo -i -u wrolpi` so
sudo/PAM stop spamming the journal when help.sh runs as a systemd
service. Drop the raw pg_lsclusters table and the per-file PMTiles
listing. Use `openssl x509 -checkhost` for the hostname SAN check so a
short hostname (e.g. "pi") cannot substring-match another SAN and
wrapped SAN lines cannot cause a false failure.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
help.sh now detects invalid Caddy certificates: expired or unparseable
CA/leaf certs, a leaf expiring within 30 days, a leaf that does not match
its private key or the current hostname, and Caddy serving a stale cert
after regeneration. It also checks that the renewal script is executable
and its timer is enabled.
scripts/renew_certificates.sh was committed without the executable bit,
so wrolpi-cert-renew.service failed with "Permission denied". Set the
bit and make repair.sh restore executable bits on all scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The umbrella postgresql.service reports active with every cluster down,
which made two cluster failures look green. Show pg_lsclusters, check
the first cluster is online, verify the data directory is under
/var/lib/postgresql, and reveal a mount over /var/lib/postgresql (the
Portable bind layout — wrong on an installed system).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Replace nginx with Caddy as the web server for both Docker and native
(RPi/Debian) deployments. Caddy handles HTTPS termination, reverse
proxying to all services (API, React app, Controller, Kiwix, Help, Map),
and serves the media/download file browsers.
- Generate a Root CA and signed leaf certificates for HTTPS. The Root CA
uses Name Constraints to restrict signing to local addresses only
(.local, localhost, and RFC 1918 private IP ranges), mitigating MITM
risk if the CA key is compromised.
- Add an HTTP landing page that guides users through one-time CA
certificate installation on iOS, Android, macOS, Windows, Linux, and
Firefox, with auto-redirect when the cert is already trusted.
- Add trailing-slash redirects for /controller, /docs, /media, and
/download so bare paths don't fall through to the React catch-all.
- Add a Root CA download link on the Settings page under Configs.
- Update help.sh diagnostics for IPv6 listener detection and HTTP/2
status codes.
- Remove all nginx config files and the https_proxy Docker container.
- Bump wrolpi-help submodule with certificate documentation.
