docs: sync local vault content to remote

Update index pages, troubleshooting articles, README, and deploy status
to match current local vault state.
This commit is contained in:
2026-03-12 18:03:52 -04:00
parent ca81761cb3
commit f35d1abdc6
8 changed files with 171 additions and 234 deletions

View File

@@ -1,29 +1,29 @@
# 🐧 Linux & Sysadmin # 🐧 Linux & Sysadmin
A collection of guides covering Linux administration, shell scripting, networking, and distro-specific topics. A collection of guides covering Linux administration, shell scripting, networking, and distro-specific topics.
## Files & Permissions ## Files & Permissions
- [Linux File Permissions and Ownership](files-permissions/linux-file-permissions.md) - [Linux File Permissions and Ownership](files-permissions/linux-file-permissions.md)
## Networking ## Networking
- [SSH Config & Key Management](networking/ssh-config-key-management.md) - [SSH Config & Key Management](networking/ssh-config-key-management.md)
## Package Management ## Package Management
- [Package Management Reference](packages/package-management-reference.md) - [Package Management Reference](packages/package-management-reference.md)
## Process Management ## Process Management
- [Managing Linux Services with systemd](process-management/managing-linux-services-systemd-ansible.md) - [Managing Linux Services with systemd](process-management/managing-linux-services-systemd-ansible.md)
## Shell & Scripting ## Shell & Scripting
- [Ansible Getting Started](shell-scripting/ansible-getting-started.md) - [Ansible Getting Started](shell-scripting/ansible-getting-started.md)
- [Bash Scripting Patterns](shell-scripting/bash-scripting-patterns.md) - [Bash Scripting Patterns](shell-scripting/bash-scripting-patterns.md)
## Distro-Specific ## Distro-Specific
- [Linux Distro Guide for Beginners](distro-specific/linux-distro-guide-beginners.md) - [Linux Distro Guide for Beginners](distro-specific/linux-distro-guide-beginners.md)
- [WSL2 Instance Migration to Fedora 43](distro-specific/wsl2-instance-migration-fedora43.md) - [WSL2 Instance Migration to Fedora 43](distro-specific/wsl2-instance-migration-fedora43.md)

View File

@@ -1,29 +1,29 @@
# 🏠 Self-Hosting & Homelab # 🏠 Self-Hosting & Homelab
Guides for running your own services at home, including Docker, reverse proxies, DNS, storage, monitoring, and security. Guides for running your own services at home, including Docker, reverse proxies, DNS, storage, monitoring, and security.
## Docker & Containers ## Docker & Containers
- [Self-Hosting Starter Guide](docker/self-hosting-starter-guide.md) - [Self-Hosting Starter Guide](docker/self-hosting-starter-guide.md)
- [Docker vs VMs for the Homelab](docker/docker-vs-vms-homelab.md) - [Docker vs VMs for the Homelab](docker/docker-vs-vms-homelab.md)
- [Debugging Broken Docker Containers](docker/debugging-broken-docker-containers.md) - [Debugging Broken Docker Containers](docker/debugging-broken-docker-containers.md)
## Reverse Proxies ## Reverse Proxies
- [Setting Up Caddy as a Reverse Proxy](reverse-proxy/setting-up-caddy-reverse-proxy.md) - [Setting Up Caddy as a Reverse Proxy](reverse-proxy/setting-up-caddy-reverse-proxy.md)
## DNS & Networking ## DNS & Networking
- [Tailscale for Homelab Remote Access](dns-networking/tailscale-homelab-remote-access.md) - [Tailscale for Homelab Remote Access](dns-networking/tailscale-homelab-remote-access.md)
## Storage & Backup ## Storage & Backup
- [rsync Backup Patterns](storage-backup/rsync-backup-patterns.md) - [rsync Backup Patterns](storage-backup/rsync-backup-patterns.md)
## Monitoring ## Monitoring
- [Tuning Netdata Web Log Alerts](monitoring/tuning-netdata-web-log-alerts.md) - [Tuning Netdata Web Log Alerts](monitoring/tuning-netdata-web-log-alerts.md)
## Security ## Security
- [Linux Server Hardening Checklist](security/linux-server-hardening-checklist.md) - [Linux Server Hardening Checklist](security/linux-server-hardening-checklist.md)

View File

@@ -1,7 +1,7 @@
# 🎙️ Streaming & Podcasting # 🎙️ Streaming & Podcasting
Guides for live streaming and podcast production, with a focus on OBS Studio. Guides for live streaming and podcast production, with a focus on OBS Studio.
## OBS Studio ## OBS Studio
- [OBS Studio Setup & Encoding](obs/obs-studio-setup-encoding.md) - [OBS Studio Setup & Encoding](obs/obs-studio-setup-encoding.md)

View File

@@ -1,129 +1,22 @@
--- # ISP SNI Filtering & Caddy Troubleshooting
title: ISP SNI Filtering Blocking Caddy Reverse Proxy
domain: troubleshooting
category: networking
tags:
- caddy
- tls
- sni
- isp
- google-fiber
- reverse-proxy
- troubleshooting
status: published
created: '2026-03-11'
updated: '2026-03-11'
---
# ISP SNI Filtering Blocking Caddy Reverse Proxy ## 🛑 Problem
When deploying the MajorWiki at `wiki.majorshouse.com`, the site was unreachable over HTTPS. Browsers reported a `TLS_CONNECTION_REFUSED` error.
Some ISPs — including Google Fiber — silently block TLS handshakes for certain hostnames at the network level. The connection reaches your server, TCP completes, but the TLS handshake never finishes. The symptom looks identical to a misconfigured Caddy setup or a missing certificate, which makes it a frustrating thing to debug. ## 🔍 Diagnosis
1. **Direct IP Check:** Accessing the server via IP on port 8092 worked fine.
2. **Tailscale Check:** Accessing via the Tailscale magic DNS worked fine.
3. **SNI Analysis:** Using `openssl s_client -connect <IP>:443 -servername wiki.majorshouse.com` resulted in an immediate reset by peer.
4. **Root Cause:** Google Fiber (the local ISP) appears to be performing SNI-based filtering on hostnames containing the string "wiki".
## What Happened ## ✅ Solution
The domain was changed from `wiki.majorshouse.com` to `notes.majorshouse.com`.
Deployed a new Caddy vhost for `wiki.majorshouse.com` on a Google Fiber residential connection. Everything on the server was correct: ### Caddy Configuration Update
```caddy
- Let's Encrypt cert provisioned successfully notes.majorshouse.com {
- Caddy validated clean with `caddy validate` reverse_proxy :8092
- `curl --resolve wiki.majorshouse.com:443:127.0.0.1 https://wiki.majorshouse.com` returned 200 from loopback }
- iptables had ACCEPT rules for ports 80 and 443
- All other Caddy vhosts on the same IP and port worked fine externally
But from any external host, `curl` timed out with no response. `ss -tn` showed SYN-RECV connections piling up on port 443 — the TCP handshake was completing, but the TLS handshake was stalling.
## The Debugging Sequence
**Step 1: Ruled out Caddy config issues**
```bash
caddy validate --config /etc/caddy/Caddyfile
curl --resolve wiki.majorshouse.com:443:127.0.0.1 https://wiki.majorshouse.com
``` ```
Both clean. Loopback returned 200. Once the hostname was changed to one without the "wiki" keyword, the TLS handshake completed successfully.
**Step 2: Ruled out certificate issues**
```bash
ls /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wiki.majorshouse.com/
openssl x509 -in wiki.majorshouse.com.crt -noout -text | grep -E "Subject:|Not Before|Not After"
```
Valid cert, correct subject, not expired.
**Step 3: Ruled out firewall**
```bash
iptables -L INPUT -n -v | grep -E "80|443"
ss -tlnp | grep ':443'
```
Ports open, Caddy listening on `*:443`.
**Step 4: Ruled out hairpin NAT**
Testing `curl https://wiki.majorshouse.com` from the server itself returned "No route to host" — the server can't reach its own public IP. This is normal for residential connections without NAT loopback. It's not the problem.
**Step 5: Confirmed external connectivity on port 443**
```bash
# From an external server (majormail)
curl -sk -o /dev/null -w "%{http_code}" https://git.majorshouse.com # 200
curl -sk -o /dev/null -w "%{http_code}" https://wiki.majorshouse.com # 000
```
Same IP, same port, same Caddy process. `git` works, `wiki` doesn't.
**Step 6: Tested a different subdomain**
Added `notes.majorshouse.com` as a new Caddyfile entry pointing to the same upstream. Cert provisioned via HTTP-01 challenge successfully (proving port 80 is reachable). Then:
```bash
curl -sk -o /dev/null -w "%{http_code}" https://notes.majorshouse.com # 200
curl -sk -o /dev/null -w "%{http_code}" https://wiki.majorshouse.com # 000
```
`notes` worked immediately. `wiki` still timed out.
**Conclusion:** Google Fiber is performing SNI-based filtering and blocking TLS connections where the ClientHello contains `wiki.majorshouse.com` as the server name.
## The Fix
Rename the subdomain. Use anything that doesn't trigger the filter. `notes.majorshouse.com` works fine.
```bash
# Remove the blocked entry
sed -i '/^wiki\.majorshouse\.com/,/^}/d' /etc/caddy/Caddyfile
systemctl reload caddy
```
Update `mkdocs.yml` or whatever service's config references the domain, add DNS for the new subdomain, and done.
## How to Diagnose This Yourself
If your Caddy vhost works on loopback but times out externally:
1. Confirm other vhosts on the same IP and port work externally
2. Test the specific domain from multiple external networks (different ISP, mobile data)
3. Add a second vhost with a different subdomain pointing to the same upstream
4. If the new subdomain works and the original doesn't, the hostname is being filtered
```bash
# Quick external test — run from a server outside your network
curl -sk -o /dev/null -w "%{http_code}" --max-time 10 https://your-domain.com
```
If you get `000` (connection timeout, not a TLS error like `curl: (35)`), the TCP connection isn't completing — pointing to network-level blocking rather than a Caddy or cert issue.
## Gotchas & Notes
- **`curl: (35) TLS error` is different from `000`.** A TLS error means TCP connected but the handshake failed — usually a missing or invalid cert. A `000` timeout means TCP never completed — a network or firewall issue.
- **SYN-RECV in `ss -tn` means TCP is partially open.** If you see SYN-RECV entries for your domain but the connection never moves to ESTAB, something between the client and your TLS stack is dropping the handshake.
- **ISP SNI filtering is uncommon but real.** Residential ISPs sometimes filter on SNI for terms associated with piracy, proxies, or certain categories of content. "Wiki" may trigger a content-type heuristic.
- **Loopback testing isn't enough.** Always test from an external host before declaring a service working. The server can't test its own public IP on most residential connections.
## See Also
- [[setting-up-caddy-reverse-proxy]]
- [[linux-server-hardening-checklist]]
- [[tailscale-homelab-remote-access]]

View File

@@ -135,3 +135,42 @@ This is a YouTube-side experiment. yt-dlp falls back to other clients automatica
yt-dlp --version yt-dlp --version
pip show yt-dlp pip show yt-dlp
``` ```
### Format Not Available: Strict AVC+M4A Selector
The format selector `bestvideo[vcodec^=avc]+bestaudio[ext=m4a]` will hard-fail if YouTube doesn't serve H.264 (AVC) video for a given video:
```
ERROR: [youtube] Requested format is not available. Use --list-formats for a list of available formats
```
This is separate from the n-challenge issue — the format simply doesn't exist for that video (common with newer uploads that are VP9/AV1-only).
**Fix 1 — Relax the selector to mp4 container without enforcing codec:**
```bash
yt-dlp -f 'bestvideo[ext=mp4]+bestaudio[ext=m4a]/bestvideo+bestaudio' \
--merge-output-format mp4 \
-o "/plex/plex/%(title)s.%(ext)s" \
--write-auto-subs --embed-subs \
https://youtu.be/VIDEO_ID
```
**Fix 2 — Let yt-dlp pick best and re-encode to H.264 via ffmpeg (Plex-safe, slower):**
```bash
yt-dlp -f 'bestvideo+bestaudio' \
--merge-output-format mp4 \
--recode-video mp4 \
-o "/plex/plex/%(title)s.%(ext)s" \
--write-auto-subs --embed-subs \
https://youtu.be/VIDEO_ID
```
Use `--recode-video mp4` when Plex direct play is required and the source stream may be VP9/AV1. Requires ffmpeg.
**Inspect available formats first:**
```bash
yt-dlp --list-formats https://youtu.be/VIDEO_ID
```

View File

@@ -48,5 +48,13 @@ rsync -av --include="*.md" --include="*/" --exclude="*" \
## Backlog ## Backlog
- [ ] Gitea webhook for auto-deploy on push - [✅] Gitea webhook for auto-deploy on push (Active as of 2026-03-11)
- [ ] Add `03-opensource` and `05-troubleshooting` articles - [ ] Add `03-opensource` and `05-troubleshooting` articles (Troubleshooting seeded)
## Incident Log
### 2026-03-11 — 502 Error & Webhook Repair
- **Issue:** Wiki returned 502 Bad Gateway.
- **Cause:** `majwiki` container was in a restart loop due to a `LiterateNavParseError` in `SUMMARY.md` (invalid globbing syntax).
- **Repair:** Rewrote `SUMMARY.md` with explicit links. Repaired `majwiki-webhook.service` by killing an orphaned process and correcting the Caddy reverse proxy routing for `/webhook`.
- **Result:** Site live and auto-deployment functional.

View File

@@ -1,4 +1,3 @@
# MajorLinux Tech Wiki — Index # MajorLinux Tech Wiki — Index
> A growing reference of Linux, self-hosting, open source, streaming, and troubleshooting guides. Written by MajorLinux. Used by MajorTwin. > A growing reference of Linux, self-hosting, open source, streaming, and troubleshooting guides. Written by MajorLinux. Used by MajorTwin.
@@ -6,8 +5,6 @@
> **Last updated:** 2026-03-11 > **Last updated:** 2026-03-11
> **Article count:** 20 > **Article count:** 20
---
## Domains ## Domains
| Domain | Folder | Articles | | Domain | Folder | Articles |
@@ -23,48 +20,48 @@
## 🐧 Linux & Sysadmin ## 🐧 Linux & Sysadmin
### Files & Permissions ### Files & Permissions
- [[linux-file-permissions]] — chmod, chown, special bits, finding permission problems - [Linux File Permissions](01-linux/files-permissions/linux-file-permissions.md) — chmod, chown, special bits, finding permission problems
### Process Management ### Process Management
- [[managing-linux-services-systemd-ansible]] — systemctl, journalctl, writing service files, Ansible service management - [Managing Linux Services with systemd](01-linux/process-management/managing-linux-services-systemd-ansible.md) — systemctl, journalctl, writing service files, Ansible service management
### Networking ### Networking
- [[ssh-config-key-management]] — key generation, ssh-copy-id, ~/.ssh/config, managing multiple keys - [SSH Config & Key Management](01-linux/networking/ssh-config-key-management.md) — key generation, ssh-copy-id, ~/.ssh/config, managing multiple keys
### Package Management ### Package Management
- [[package-management-reference]] — apt, dnf, pacman side-by-side reference, Flatpak/Snap - [Package Management Reference](01-linux/packages/package-management-reference.md) — apt, dnf, pacman side-by-side reference, Flatpak/Snap
### Shell & Scripting ### Shell & Scripting
- [[ansible-getting-started]] — inventory, ad-hoc commands, playbooks, handlers, roles - [Ansible Getting Started](01-linux/shell-scripting/ansible-getting-started.md) — inventory, ad-hoc commands, playbooks, handlers, roles
- [[bash-scripting-patterns]] — set -euo pipefail, logging, error handling, argument parsing, common patterns - [Bash Scripting Patterns](01-linux/shell-scripting/bash-scripting-patterns.md) — set -euo pipefail, logging, error handling, argument parsing, common patterns
### Distro-Specific ### Distro-Specific
- [[linux-distro-guide-beginners]] — Ubuntu recommendation, distro comparison, desktop environments - [Linux Distro Guide for Beginners](01-linux/distro-specific/linux-distro-guide-beginners.md) — Ubuntu recommendation, distro comparison, desktop environments
- [[wsl2-instance-migration-fedora43]] — moving WSL2 VHDX from C: to another drive - [WSL2 Instance Migration to Fedora 43](01-linux/distro-specific/wsl2-instance-migration-fedora43.md) — moving WSL2 VHDX from C: to another drive
--- ---
## 🏠 Self-Hosting & Homelab ## 🏠 Self-Hosting & Homelab
### Docker & Containers ### Docker & Containers
- [[self-hosting-starter-guide]] — hardware options, Docker install, first services, networking basics - [Self-Hosting Starter Guide](02-selfhosting/docker/self-hosting-starter-guide.md) — hardware options, Docker install, first services, networking basics
- [[docker-vs-vms-homelab]] — when to use containers vs VMs, KVM setup, how to run both - [Docker vs VMs for the Homelab](02-selfhosting/docker/docker-vs-vms-homelab.md) — when to use containers vs VMs, KVM setup, how to run both
- [[debugging-broken-docker-containers]] — logs, inspect, exec, port conflicts, permission errors - [Debugging Broken Docker Containers](02-selfhosting/docker/debugging-broken-docker-containers.md) — logs, inspect, exec, port conflicts, permission errors
### Reverse Proxies ### Reverse Proxies
- [[setting-up-caddy-reverse-proxy]] — Caddyfile basics, automatic HTTPS, local TLS, DNS challenge - [Setting Up Caddy as a Reverse Proxy](02-selfhosting/reverse-proxy/setting-up-caddy-reverse-proxy.md) — Caddyfile basics, automatic HTTPS, local TLS, DNS challenge
### DNS & Networking ### DNS & Networking
- [[tailscale-homelab-remote-access]] — installation, MagicDNS, making services accessible, subnet router, ACLs - [Tailscale for Homelab Remote Access](02-selfhosting/dns-networking/tailscale-homelab-remote-access.md) — installation, MagicDNS, making services accessible, subnet router, ACLs
### Storage & Backup ### Storage & Backup
- [[rsync-backup-patterns]] — flags reference, remote backup, incremental with hard links, cron/systemd - [rsync Backup Patterns](02-selfhosting/storage-backup/rsync-backup-patterns.md) — flags reference, remote backup, incremental with hard links, cron/systemd
### Monitoring ### Monitoring
- [[tuning-netdata-web-log-alerts]] — tuning web_log_1m_redirects threshold for HTTPS-forcing servers - [Tuning Netdata Web Log Alerts](02-selfhosting/monitoring/tuning-netdata-web-log-alerts.md) — tuning web_log_1m_redirects threshold for HTTPS-forcing servers
### Security ### Security
- [[linux-server-hardening-checklist]] — non-root user, SSH key auth, sshd_config, firewall, fail2ban - [Linux Server Hardening Checklist](02-selfhosting/security/linux-server-hardening-checklist.md) — non-root user, SSH key auth, sshd_config, firewall, fail2ban
--- ---
@@ -77,16 +74,16 @@
## 🎙️ Streaming & Podcasting ## 🎙️ Streaming & Podcasting
### OBS Studio ### OBS Studio
- [[obs-studio-setup-encoding]] — installation, NVENC/x264 settings, scene setup, audio filters, Linux Wayland notes - [OBS Studio Setup & Encoding](04-streaming/obs/obs-studio-setup-encoding.md) — installation, NVENC/x264 settings, scene setup, audio filters, Linux Wayland notes
--- ---
## 🔧 General Troubleshooting ## 🔧 General Troubleshooting
- [[isp-sni-filtering-caddy]] — troubleshooting why wiki.majorshouse.com was blocked by Google Fiber - [ISP SNI Filtering with Caddy](05-troubleshooting/isp-sni-filtering-caddy.md) — troubleshooting why wiki.majorshouse.com was blocked by Google Fiber
- [[obsidian-cache-hang-recovery]] — resolving "Loading cache" hang in Obsidian by cleaning Electron app data and ML artifacts - [Obsidian Cache Hang Recovery](05-troubleshooting/obsidian-cache-hang-recovery.md) — resolving "Loading cache" hang in Obsidian by cleaning Electron app data and ML artifacts
- [[yt-dlp-fedora-js-challenge]] — fixing YouTube JS challenge solver errors and missing formats on Fedora - [yt-dlp JS Challenge Fix on Fedora](05-troubleshooting/yt-dlp-fedora-js-challenge.md) — fixing YouTube JS challenge solver errors and missing formats on Fedora
- [[majwiki-setup-and-pipeline]] — setting up MajorWiki and the Obsidian → Gitea → MkDocs publishing pipeline - [MajorWiki Setup & Pipeline](05-troubleshooting/majwiki-setup-and-pipeline.md) — setting up MajorWiki and the Obsidian → Gitea → MkDocs publishing pipeline
--- ---
@@ -94,19 +91,19 @@
| Date | Article | Domain | | Date | Article | Domain |
|---|---|---| |---|---|---|
| 2026-03-11 | [[majwiki-setup-and-pipeline]] | Troubleshooting | | 2026-03-11 | [MajorWiki Setup & Pipeline](05-troubleshooting/majwiki-setup-and-pipeline.md) | Troubleshooting |
| 2026-03-11 | [[obsidian-cache-hang-recovery]] | Troubleshooting | | 2026-03-11 | [Obsidian Cache Hang Recovery](05-troubleshooting/obsidian-cache-hang-recovery.md) | Troubleshooting |
| 2026-03-11 | [[yt-dlp-fedora-js-challenge]] | Troubleshooting | | 2026-03-11 | [yt-dlp JS Challenge Fix on Fedora](05-troubleshooting/yt-dlp-fedora-js-challenge.md) | Troubleshooting |
| 2026-03-08 | [[obs-studio-setup-encoding]] | Streaming | | 2026-03-08 | [OBS Studio Setup & Encoding](04-streaming/obs/obs-studio-setup-encoding.md) | Streaming |
| 2026-03-08 | [[linux-file-permissions]] | Linux | | 2026-03-08 | [Linux File Permissions](01-linux/files-permissions/linux-file-permissions.md) | Linux |
| 2026-03-08 | [[rsync-backup-patterns]] | Self-Hosting | | 2026-03-08 | [rsync Backup Patterns](02-selfhosting/storage-backup/rsync-backup-patterns.md) | Self-Hosting |
| 2026-03-08 | [[tailscale-homelab-remote-access]] | Self-Hosting | | 2026-03-08 | [Tailscale for Homelab Remote Access](02-selfhosting/dns-networking/tailscale-homelab-remote-access.md) | Self-Hosting |
| 2026-03-08 | [[package-management-reference]] | Linux | | 2026-03-08 | [Package Management Reference](01-linux/packages/package-management-reference.md) | Linux |
| 2026-03-08 | [[bash-scripting-patterns]] | Linux | | 2026-03-08 | [Bash Scripting Patterns](01-linux/shell-scripting/bash-scripting-patterns.md) | Linux |
| 2026-03-08 | [[setting-up-caddy-reverse-proxy]] | Self-Hosting | | 2026-03-08 | [Setting Up Caddy as a Reverse Proxy](02-selfhosting/reverse-proxy/setting-up-caddy-reverse-proxy.md) | Self-Hosting |
| 2026-03-08 | [[ssh-config-key-management]] | Linux | | 2026-03-08 | [SSH Config & Key Management](01-linux/networking/ssh-config-key-management.md) | Linux |
| 2026-03-08 | [[ansible-getting-started]] | Linux | | 2026-03-08 | [Ansible Getting Started](01-linux/shell-scripting/ansible-getting-started.md) | Linux |
| 2026-03-08 | [[self-hosting-starter-guide]] | Self-Hosting | | 2026-03-08 | [Self-Hosting Starter Guide](02-selfhosting/docker/self-hosting-starter-guide.md) | Self-Hosting |
--- ---

View File

@@ -7,13 +7,13 @@
## Domains ## Domains
| Domain | Folder | Articles | | Domain | Folder | Articles |
|---|---|---| | -------------------------- | --------------------- | -------- |
| 🐧 Linux & Sysadmin | `01-linux/` | 8 | | 🐧 Linux & Sysadmin | `01-linux/` | 8 |
| 🏠 Self-Hosting & Homelab | `02-selfhosting/` | 7 | | 🏠 Self-Hosting & Homelab | `02-selfhosting/` | 7 |
| 🔓 Open Source Tools | `03-opensource/` | 0 | | 🔓 Open Source Tools | `03-opensource/` | 0 |
| 🎙️ Streaming & Podcasting | `04-streaming/` | 1 | | 🎙️ Streaming & Podcasting | `04-streaming/` | 1 |
| 🔧 General Troubleshooting | `05-troubleshooting/` | 4 | | 🔧 General Troubleshooting | `05-troubleshooting/` | 4 |
--- ---