nginx default site: template relies on /var/www/index.html that PMSS never ships, fresh nodes return 403 on /

[MagnaCapax]

Origin: Customer support ticket. Suggested Fix reflects ticket agent
investigation — do not derive fix from title or symptom alone.

Summary

On freshly built seedbox nodes, a GET of / on the node hostname returns 403 Forbidden where it should show the standard "Pulsed Media Seedbox Server" landing page. Two freshly built nodes show it; an older sibling built the same week serves the page normally.

Root Cause

The nginx default site generated from template.nginx-site-default serves root /var/www; index index.html;. On the affected nodes, /var/www/index.html does not exist, so nginx logs:

directory index of "/var/www/" is forbidden

The landing page is not provisioned by PMSS at all:

• The repo var/www/ tree (error pages, index.lighttpd.html, index.php, status.php, image dirs) has no index.html.
• On nodes that do show the page, /var/www/index.html is a 357-byte file dated 2019, owned by no Debian package (dpkg -S finds nothing). It exists only because older install images carried it.

The template also depends on the file elsewhere: location / falls back with try_files $uri $uri/ /index.html, so on the same nodes a request for a missing path logs rewrite or internal redirection cycle while internally redirecting to "/index.html" instead of a clean 404.

So template.nginx-site-default references a file PMSS never ships. Any node built from an image without that file shows a 403 on its public root, which is a visible degradation of a public page.

Reproduction

1. On a node built from a current image: ls /var/www/index.html returns no such file.
2. curl -s -o /dev/null -w '%{http_code}' https://<node-hostname>/ returns 403.
3. tail /var/log/nginx/error.log shows directory index of "/var/www/" is forbidden.

Environment

Debian 12, PMSS git/main@2026-09-24, nginx default site from the current template.

Suggested Fix

Close the gap between the template and what PMSS ships. Preferred: ship var/www/index.html in the PMSS repo so it is provisioned with the rest of var/www/. update.php stages the var tree with cp -a <snapshot>/var / (overlay copy, scripts/update.php ~L1572), so the next update places it on every node.

Because that overlay overwrites the existing file on older nodes, reuse the current landing page text unchanged ("Pulsed Media Seedbox Server" / "Looking to login to your seedbox? Check the welcome e-mail for the direct URL to your seedbox." / link to pulsedmedia.com). Do not write new copy, or the page changes across the whole fleet on the next update.

Acceptance: after update.php on an affected node, / returns 200 with the landing text, and an older node's page is unchanged.

(An empty hall; the doorplate went missing.)

---

_{Tier-3 declared at filing: --why public-surface — GH#631 tier gate. Declared fix size: 12 lines vs 43-line body — size gate (operator directive 2026-07-29). Owner: etc/seedbox/config/template.nginx-site-default in MagnaCapax/PMSS — owner gate.}