plan/23-monitor.md already covered the design; this makes the monitor
discoverable from the places someone actually starts reading.
- README: stack table, vhost list, DNS names, layout, and a setup section
covering the bcrypt credential, the no-published-port model, and the
--hard-on-first-deploy requirement.
- plan/00-overview.md: drop (PLANNED), add to the always-on service list, and
note that it starts fine with Minecraft down (missing log and refused RCON
are reported states, not fatal).
- plan/19-routes.md: vhost row, the four GET routes with their contracts, and
the internal mcnet edges (mc-status for rosters so it needs no Drasl creds,
RCON for TPS, Kuma probing healthz around caddy).
- caddy/Caddyfile: the snippet index had drifted — it listed five of nine
vhosts. Added the four missing ones.
Two gotchas promoted to CLAUDE.md because they cost real time and will recur:
- Compose interpolates $-sequences in .env VALUES, so a bare bcrypt hash is
silently corrupted before reaching the container, and the same bug bites
again when writing one to a remote .env over ssh. Also records that caddy
and filestash want opposite hash formats.
- The monitor container runs as root deliberately: /data is drwxr-x--- owned
by uid 1000, so a USER directive would make the tailer silently read nothing
while still returning 200.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
oierandClaude Opus 5
bac2372c95