sam-4screen-desktop 2026-9-9:18:24:8

300 areas/360 Dev-Ops Network Computers/Error Tracking.md

@@ -72,3 +72,27 @@ Two failures blocked the request path.
 - Changed `app.py` MQTT intake to retry and reconnect. Backup: `app.py.bak-mqtt-20260906`.
 - Run `sudo systemctl restart voice-agent` to load the change.
 - DeepSeek key is valid but the account balance is zero. Add credit at platform.deepseek.com.
+
+---
+
+# 2026-09-09 — Garage S3 web returns 404/403 for site images (anonymous hosting)
+
+## Symptom
+A Go + htmx site (being built for `kontra.day`) tried to serve uploaded images through **Garage S3 web** (`:3902`) and got `404` on the bucket root and `403 Forbidden: Garage does not support anonymous access yet` in `docker logs family-home-lab-garage-1`.
+
+## Root cause
+Two things misled the diagnosis:
+
+1. **Wrong claim (from an earlier AI):** it said `[s3_web]` was absent and the web server wasn't running. **False** — `[s3_web]` IS in `garage.toml` (`bind_addr = "[::]:3902"`, `root_domain = ".web.lab.audasmedia.com.au"`, `index = "index.html"`) and the log shows `Web server listening on http://[::]:3902`. Verified: `ss -tln` shows 3902 bound (Garage web server), 3903 admin, 3909 garage-webui.
+2. **Real issue:** Garage S3 Web is **not anonymous static hosting**. It requires **per-bucket web access + a read-scoped access key**. Without it, every request gets `403 Forbidden: Garage does not support anonymous access yet`, and the bucket root 404s with no index/perm.
+
+## Fix / correct pattern
+- **Do NOT** point site/app code at `:3902` for anonymous browsing.
+- **Use the S3 API** (`:3900`, region `garage`) with a **read-scoped key** for uploads/reads.
+- **Serve images** through the app or **Caddy** (reverse-proxy to Garage with the read key, or a Caddy `file_server` static dir) — not via `:3902` directly.
+- If web-serving a bucket is truly needed, enable **per-bucket web access + a guest/read key** in Garage (not a global switch).
+
+## Verification / non-causes
+- `[s3_web]` present; web server confirmed running (log line + port 3902 bound) → the earlier "no s3_web / not running" diagnosis was wrong.
+- Port map: 3900 S3 API · 3902 S3 web · 3903 admin API · 3909 garage-webui. No port conflict.
+- Documented in the Garage section of [[Backup System — Borg, Kopia & Restic]] and the kontra.day site handoff.