# Notes — R5 Docker proxy runbook

Base SHA: `8284eb5d006943d42133eb665c99dcbc3133d6a6`. No commit made; current HEAD remains unchanged.

Scope stayed limited to proxy templates and the deployment runbook. Updated R5 to the reported proxy containers (`krona-proxy-mux`, HAProxy 3.0; `krona-reverse-proxy`, Caddy 2.8), with inspections of command/mounts that omit environment, config backup, same-inode edits/checks, actual config validation, reload gates, host/passthrough and cleartext backends kept separate, other-site before/after baselines, Basic Auth only, and rollback. Exact VPS paths, HAProxy routing/process model/reload, Caddy admin endpoint, DNS and peer identity remain gated UNVERIFIED facts.

Local image checks run:
- `docker run --rm --entrypoint caddy caddy:2.8-alpine version` — `v2.8.4`.
- `docker run --rm --entrypoint haproxy haproxy:3.0-alpine -vv` — `3.0.30-47d806b`.
- Caddy 2.8.4 `validate --config /dev/stdin --adapter caddyfile` against the proposed site block with an artificial hash — exit 0 / `Valid configuration`; two warnings were formatting and the explicit X-Forwarded-For override.
- HAProxy 3.0.30 `-c -f` against a temporary assembled mode-tcp SNI frontend plus separate mode-http/cleartext frontend fixture — exit 0. This fixture is not the VPS active config.
- `git diff --check -- docs/STAGE1_DEPLOYMENT_RUNBOOK.md deploy/randomayzer.Caddyfile deploy/randomayzer.nginx.conf` — exit 0.
- Python trailing-whitespace scan on the new HAProxy snippet and inbox assignment — no trailing whitespace.

No remote VPS/home-server changes, npm/app gates, Docker production stack changes, or actual TLS/VK acceptance were performed. Parent independently reported that it validated the submitted Caddy snippet and assembled HAProxy snippets with the cached target images; see `agents/codex/notes/r5-*`.