| A panel redirects to sign-in in a loop |
the service's PUBLIC_URL, its OIDC client at id, the clock on the server |
| A panel shows 502 |
xvii-node status: is the service running; its logs; did an update roll back |
| A certificate isn't issued |
DNS points at the server; port 80 reachable; the Cloudflare token's zone; Caddy's log |
| A build fails |
the build log: Dockerfile path, context, lockfile, base image access |
| A release stays deploying, then fails |
the health path and Host header, startup migrations, memory limit, logs |
| An app answers 502 but its container runs |
the port the app listens on (PORT), the node's relay port 7443, the edge state |
| DNS still points at an old node |
domains reconciles every two minutes; the record's TTL; resolvers' caches |
| Sign-in fails after a migration |
the public origin, the OIDC callback URL, the client's secret, the database restored |
| Mail can't be sent |
outbound port reachability (25, 465, 587), relay credentials, SPF/DKIM/DMARC |
| A private image can't be pulled |
the team's registry entry, the token's scope, the tag, the node's network |
| A signed zone returns SERVFAIL |
the parent's DS against the DNSKEY, both name servers' copies, the clock |
| Backups fail |
the destination's credentials and free space; the run's log in backups |
| An agent update restarted a job |
agent updates restart the relay proxy briefly; retry the job |