From e31c1fa99bf1609681450cf0aeb178e3fb615936 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Tue, 12 May 2026 11:02:42 +0200 Subject: [PATCH] fix(sync-routes): preserve streamlit & custom routes from clobbering MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After Session 156 fix, secubox-haproxy.service was safely restarted but cpf.gk2.secubox.in (and other streamlit instances) immediately fell back to "Wrong Domain" because sync-mitmproxy-routes.sh was clobbering their container routes. Two compounding bugs: 1. DEAD_CONTAINER_IPS included 10.100.0.50 — but that's the streamlit LXC's actual IP (RUNNING). fix_dead_container_routes() rewrote every route pointing to 10.100.0.50 (cpf:8523, etc.) to 10.100.0.1:9080. 2. The update conditional reapplied routes when the existing port didn't match the computed port. The computed port logic only knows metablog vs webui — it has no streamlit awareness, so it always tried to force streamlit domains to port 9080 (webui default). Fixes: - Drop 10.100.0.50 from DEAD_CONTAINER_IPS. The streamlit LXC at that address is alive; routes pointing to it are valid. - Change "update if existing missing OR port mismatch" to "update only if existing is missing." The script now only ADDS routes for ACL/ metablog domains; it never overwrites existing routes set by other sources (sync-all-routes.sh, manual edits, etc.). fix_dead_container_ routes() still handles truly dead IPs separately. Verified: cpf.gk2.secubox.in → HTTP 200 "Streamlit" persists across sync-mitmproxy-routes.service runs. arm/admin still 200 with correct content. Co-Authored-By: Claude Opus 4.7 (1M context) --- scripts/sync-mitmproxy-routes.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/sync-mitmproxy-routes.sh b/scripts/sync-mitmproxy-routes.sh index e1525cd5..82e91a2b 100644 --- a/scripts/sync-mitmproxy-routes.sh +++ b/scripts/sync-mitmproxy-routes.sh @@ -26,7 +26,7 @@ METABLOG_PORT=8900 BACKEND_IP="10.100.0.1" # Dead container IPs to fix (not running LXC containers) -DEAD_CONTAINER_IPS="10.100.0.10 10.100.0.20 10.100.0.30 10.100.0.40 10.100.0.50" +DEAD_CONTAINER_IPS="10.100.0.10 10.100.0.20 10.100.0.30 10.100.0.40" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >&2 @@ -110,7 +110,7 @@ main() { # Check if route exists with correct port existing=$(echo "$routes_json" | jq -r --arg d "$domain" '.[$d] // empty' 2>/dev/null || true) - if [[ -z "$existing" ]] || ! echo "$existing" | jq -e ".[1] == $port" >/dev/null 2>&1; then + if [[ -z "$existing" ]]; then log "Updating route: $domain -> $BACKEND_IP:$port" new_rj=$(echo "$routes_json" | jq --arg d "$domain" --arg ip "$BACKEND_IP" --argjson p "$port" '.[$d] = [$ip, $p]' 2>/dev/null || true) if [[ -n "$new_rj" ]]; then routes_json="$new_rj"; fi @@ -124,7 +124,7 @@ main() { existing=$(echo "$routes_json" | jq -r --arg d "$domain" '.[$d] // empty' 2>/dev/null || true) - if [[ -z "$existing" ]] || ! echo "$existing" | jq -e ".[1] == $METABLOG_PORT" >/dev/null 2>&1; then + if [[ -z "$existing" ]]; then log "Updating metablog route: $domain -> $BACKEND_IP:$METABLOG_PORT" new_rj=$(echo "$routes_json" | jq --arg d "$domain" --arg ip "$BACKEND_IP" --argjson p "$METABLOG_PORT" '.[$d] = [$ip, $p]' 2>/dev/null || true) if [[ -n "$new_rj" ]]; then routes_json="$new_rj"; fi