# Result — R5 runbook for existing proxy containers

Base SHA: `8284eb5d006943d42133eb665c99dcbc3133d6a6`
Result SHA: `8284eb5d006943d42133eb665c99dcbc3133d6a6` (working-tree edits only; no commit)

## Files changed

- `deploy/randomayzer.Caddyfile` — Caddy 2.8 site snippet, Basic Auth fallback, 1 MB request body limit, no access log, safe header overrides, no second proxy/listener.
- `deploy/randomayzer.haproxy.cfg` — additive SNI/HTTP routing examples with separate TLS and cleartext Caddy backends and explicit preservation of existing routes/default behavior.
- `deploy/randomayzer.nginx.conf` — removed obsolete nginx alternative, which does not match the confirmed Docker Caddy/HAProxy setup.
- `docs/STAGE1_DEPLOYMENT_RUNBOOK.md` — R5 operator procedure for actual container topology, redacted inspection, private backups, in-place source updates and inode/hash checks, pre/post validation, no-restart reload gates, other-site baselines, external checks, and rollback. Historical R4 loopback steps remain in place.
- `agents/codex/inbox/2026-10-19-r5-vps-container-runbook.md`
- `agents/codex/notes/2026-10-19-r5-vps-container-runbook.md`
- `agents/codex/done/2026-10-19-r5-vps-container-runbook.md`

## Verification actually run

- `docker run --rm --entrypoint caddy caddy:2.8-alpine version` — exit 0, local image reports `v2.8.4`.
- `docker run --rm --entrypoint haproxy haproxy:3.0-alpine -vv` — exit 0, local image reports `3.0.30-47d806b`.
- `docker run --rm -i --entrypoint caddy caddy:2.8-alpine validate --config /dev/stdin --adapter caddyfile` with the proposed site block and an artificial bcrypt hash — exit 0, `Valid configuration`; formatting and explicit X-Forwarded-For warnings only.
- `python3` temporary-fixture harness running `docker run --rm -v <tempdir>:/tmp/config:ro --entrypoint haproxy haproxy:3.0-alpine -c -f /tmp/config/haproxy.cfg` — exit 0. The fixture includes TCP SNI routing plus a distinct HTTP/cleartext backend; it is not the unknown active VPS config.
- `git diff --check -- docs/STAGE1_DEPLOYMENT_RUNBOOK.md deploy/randomayzer.Caddyfile deploy/randomayzer.nginx.conf` — exit 0.
- Python trailing-whitespace scan on the new HAProxy example and task inbox — no trailing whitespace.

Parent separately reported target-image validation of these templates; evidence files are under `agents/codex/notes/r5-*`.

No npm, Prisma or application test/lint/build gates were run for this documentation/config-template task. No remote machine was accessed or changed.

Findings: no new CRITICAL/HIGH/MEDIUM/LOW finding from these local template checks. The runbook intentionally leaves live R5 blocked until actual inspection confirms the host source/config paths, active SNI/HTTP routing, safe HAProxy reload mechanism, Caddy admin endpoint, correct DNS and WG peer. No HAProxy signal/restart is guessed.

UNVERIFIED: exact deployed patch versions; actual HAProxy topology/backend names/master-worker/control socket/reload procedure; active mounted config source paths and inode semantics; port-80 path to Caddy; whether Authelia policy is usable for this vhost; DNS target and peer identity; live issuance/renewal, Basic Auth/VK callback, other-site health and network isolation. No production claim is made.

Remaining blockers: operator/owner must perform the gated inspection and live acceptance. Non-blocking tech debt: none identified in this scoped task.