randomayzer/agents/codex/notes/2026-10-19-r5-vps-container-runbook.md

Notes — R5 Docker proxy runbook

Base SHA: 8284eb5d006943d42133eb665c99dcbc3133d6a6. No commit made; current HEAD remains unchanged.

Scope stayed limited to proxy templates and the deployment runbook. Updated R5 to the reported proxy containers (krona-proxy-mux, HAProxy 3.0; krona-reverse-proxy, Caddy 2.8), with inspections of command/mounts that omit environment, config backup, same-inode edits/checks, actual config validation, reload gates, host/passthrough and cleartext backends kept separate, other-site before/after baselines, Basic Auth only, and rollback. Exact VPS paths, HAProxy routing/process model/reload, Caddy admin endpoint, DNS and peer identity remain gated UNVERIFIED facts.

Local image checks run:

• docker run --rm --entrypoint caddy caddy:2.8-alpine version — v2.8.4.
• docker run --rm --entrypoint haproxy haproxy:3.0-alpine -vv — 3.0.30-47d806b.
• Caddy 2.8.4 validate --config /dev/stdin --adapter caddyfile against the proposed site block with an artificial hash — exit 0 / Valid configuration; two warnings were formatting and the explicit X-Forwarded-For override.
• HAProxy 3.0.30 -c -f against a temporary assembled mode-tcp SNI frontend plus separate mode-http/cleartext frontend fixture — exit 0. This fixture is not the VPS active config.
• git diff --check -- docs/STAGE1_DEPLOYMENT_RUNBOOK.md deploy/randomayzer.Caddyfile deploy/randomayzer.nginx.conf — exit 0.
• Python trailing-whitespace scan on the new HAProxy snippet and inbox assignment — no trailing whitespace.

No remote VPS/home-server changes, npm/app gates, Docker production stack changes, or actual TLS/VK acceptance were performed. Parent independently reported that it validated the submitted Caddy snippet and assembled HAProxy snippets with the cached target images; see agents/codex/notes/r5-*.