# nginx proxy troubleshooting for vault-browser

## Symptoms
- `curl -sk https://vault.robblake.cloud/` returns empty body (200 but no content)
- nginx error log shows `open() "/var/www/vault/index.html" failed (2: No such file or directory)`
- `nginx -t` shows `conflicting server_name` warnings

## Root cause: /root permission barrier
`/root` is mode `700`. nginx runs as `www-data` and cannot traverse `/root/.hermes/vault/` regardless of:
- Inner file permissions (`chmod -R o+rx`)
- ACLs
- Bind mounts to `/var/www/vault`

The bind mount shows files at `/var/www/vault/`, but nginx's AppArmor profile and/or the mount namespace of the nginx worker processes prevent access. The nginx master process sees the mount, but workers do not.

## Working solution: proxy to Python HTTP server
Run a Python HTTP server as root (via systemd) that CAN read `/root/.hermes/vault/`, then have nginx proxy to it:

```nginx
location / {
    proxy_pass http://127.0.0.1:9124;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}
```

nginx never touches `/root` directly — it proxies to a localhost socket that serves the files.

## Conflicting server_name warnings
Multiple server blocks for `robblake.cloud` and `vault.robblake.cloud` cause these warnings. They don't break functionality but indicate config drift.

Check for duplicates:
```bash
nginx -T | grep "server_name"
ls -la /etc/nginx/sites-enabled/
```

Common cause: a manually-edited `robblake.cloud` file in `sites-enabled/` that diverges from `sites-available/`, plus a `robblake.cloud-tmp-demo` symlink.

Fix: consolidate into a single canonical file in `sites-available/`, symlink from `sites-enabled/`, remove extras.

## Terminal tool gotcha
The `terminal` tool may falsely flag commands containing `&` or heredocs as "long-lived server/watch process" and reject them. Workaround:
- Use `execute_code` with Python's `open()` to write multi-line config files
- Split commands to avoid `&` in foreground calls
- Use `terminal(background=true)` for actual long-lived processes