admin/app-catalog-felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

crafty-controller: Traefik https backend scheme + scoped skip-verify transport (fixes 502 to TLS backend)

Browse Source
This commit is contained in:
authentik Default Admin
2026-06-26 10:28:59 +02:00
parent 9abd392247
commit 1216a8a78a
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+13
View File
@@ -1,5 +1,18 @@
# Changelog
## 2026-06-26 — crafty-controller: Traefik https backend + scoped skip-verify (fixes 502)
- **crafty-controller**: the healthcheck fix un-withheld the Traefik route, exposing a pre-existing
**502** — Traefik proxied `http://…:8443` to Crafty's **HTTPS-only** self-signed backend (Crafty serves
no plain-HTTP panel; `:8000` only redirects). Added two service labels:
- `loadbalancer.server.scheme=https` — Traefik now speaks HTTPS to the backend.
- `loadbalancer.serverstransport=insecure-skip-verify@file` — references the **named**
serversTransport defined in the controller-managed Traefik dynamic config (felhom-controller v0.83.0),
which skips verifying Crafty's per-container self-signed cert. Verification stays ON for every other
backend (scoped Option B; no global `insecureSkipVerify`). The `@file` suffix is the cross-provider
reference from the docker provider to the file-provider transport.
- Requires felhom-controller ≥ v0.83.0 (which renders the `insecure-skip-verify` transport). `port=8443`
and the router/tls labels are unchanged.
## 2026-06-26 — crafty-controller healthcheck fix (curl-absent + http-vs-TLS probe)
- **crafty-controller**: container was permanently `unhealthy` → route withheld (`routeUnpublished`).
Two independent healthcheck root causes, both fixed in one change:
templates/crafty-controller/docker-compose.yml
+5
View File
@@ -38,6 +38,11 @@ services:
- "traefik.http.routers.crafty-controller.tls=true"
- "traefik.http.routers.crafty-controller.tls.certresolver=letsencrypt"
- "traefik.http.services.crafty-controller.loadbalancer.server.port=8443"
# Crafty serves self-signed HTTPS on :8443 (no plain-HTTP panel) — Traefik must speak https to the
# backend and skip verifying the per-container self-signed cert (named transport defined in the
# controller-managed traefik dynamic config; verification stays ON for all other backends).
- "traefik.http.services.crafty-controller.loadbalancer.server.scheme=https"
- "traefik.http.services.crafty-controller.loadbalancer.serverstransport=insecure-skip-verify@file"
volumes:
crafty_backups: