apply creates the observability data dirs; Caddyfile.example regenerated with the diag block

Without those three directories Docker creates them root-owned and victorialogs, victoriametrics (uid 1000)
and alertmanager (65534) cannot write, so the apply has to make them the way it already makes /srv/bot.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Caddyfile.example

@@ -49,6 +49,11 @@ name:   {http.request.header.X-Authentik-Name}"
 	}
 }
 
+# vanguard:apex
+example.com {
+	redir https://media.example.com/ 302
+}
+
 # vanguard:files
 files.example.com {
 	encode zstd gzip
@@ -77,7 +82,7 @@ files.example.com {
 	# copyparty at the root. It honours X-Authentik-Username / -Groups only when the request also carries a header
 	# whose secret NAME only this proxy knows (copyparty idp-h-key). Clients cannot forge identity.
 	reverse_proxy 127.0.0.1:3923 {
-		header_up X-Vanguard-k 1
+		header_up X-Vanguard-EXAMPLEKEY 1
 		flush_interval -1
 	}
 }
@@ -202,15 +207,9 @@ diag.example.com {
 		reverse_proxy 127.0.0.1:8881          # vmalert over VictoriaLogs
 	}
 	handle {
-		respond "Vanguard diagnostics
-
-/logs            logs (VictoriaLogs)
-/metrics-db      metrics (VictoriaMetrics)
-/alerts          what is firing (Alertmanager)
-/rules-metrics   metric rules (vmalert)
-/rules-logs      log rules (vmalert)
-
-Alerts go to Discord. The deadman runs on the host and watches this stack." 200
+		root * /srv/diag
+		try_files {path} /index.html
+		file_server                           # diag/index.html: what each path above is
 	}
 }
 

configure.py

@@ -639,6 +639,8 @@ def apply(domain, admin_pw, streamers, editors, auth_host="", watch_host="", dis
         print("   (deploy pipeline files missing — deploy.sh / systemd/deploy-pending.* not uploaded; skipping vanguard-deploy install)")
     run(["sudo", "install", "-m", "0755", "deployBotBundle.sh", "/usr/local/bin/vanguard-deploy-bot"])   # dumpd runs this for POST /deploy-bot
     run(["sudo", "install", "-d", "-o", "1000", "-g", "1000", "/srv/bot", "/srv/bot/app"])               # the bot's released bundle -> /app
+    run(["sudo", "install", "-d", "-o", "1000", "-g", "1000", "/srv/appdata/victorialogs", "/srv/appdata/victoriametrics"])
+    run(["sudo", "install", "-d", "-o", "65534", "-g", "65534", "/srv/appdata/alertmanager"])          # prom/alertmanager runs as nobody
     run(["sudo", "install", "-d", "/var/lib/vanguard"])                                                  # deadman state
     if all(Path(f).exists() for f in ("bin/vanguard-deadman.sh", "systemd/vanguard-deadman.timer")):
         run(["sudo", "install", "-m", "0755", "bin/vanguard-deadman.sh", "/usr/local/bin/"])