v0.83.0: Traefik scoped insecure-skip-verify serversTransport for self-signed HTTPS backends (fixes crafty 502)

CHANGELOG.md

@@ -1,5 +1,29 @@
 ## Changelog
 
+### v0.83.0 — Traefik scoped serversTransport for self-signed HTTPS backends (fixes crafty 502) (2026-06-26)
+- **Problem:** the crafty-controller healthcheck fix (catalog `68ce009`) un-withheld its Traefik route,
+  exposing a pre-existing 502 — Traefik proxied **HTTP** to Crafty's **HTTPS-only** self-signed backend
+  on `:8443`. Crafty is the first/only catalog app with an HTTPS backend; all others serve plain HTTP, so
+  Traefik's default HTTP transport works for them.
+- **Fix (scoped, Option B — verification stays ON by default):** the controller now renders a Traefik
+  file-provider dynamic config defining a **named** `insecure-skip-verify` serversTransport
+  (`http.serversTransports.insecure-skip-verify.insecureSkipVerify: true`). A service opts out of backend
+  TLS verification only by referencing it (`serverstransport=insecure-skip-verify@file`) — no global
+  `insecureSkipVerify` (the rejected Option A). `insecureSkipVerify` is not settable via Docker labels in
+  Traefik v3, so it must live in file/static config; the matching `scheme=https` + `@file` reference
+  labels go on the app (catalog repo).
+  - `internal/infra/infra.go`: new pure `RenderServersTransports()` + exported `ServersTransportInsecure`
+    constant.
+  - `internal/stacks/infra.go`: new `ensureServersTransports(traefikDir)` writes
+    `dynamic/serverstransports.yml` (0644) idempotently (write-only-on-change, like `wireController`, so
+    the traefik file-watcher doesn't reload each self-heal tick). Called from `EnsureBaseStack` **outside**
+    `ensureTraefik` (which early-returns when traefik is already running) so an established node still
+    materializes the file on the next self-heal tick; the watcher hot-loads it (no traefik restart).
+  - Rationale for skip-verify: a per-container self-signed cert has no CA to verify against and the hop
+    never leaves the host's internal docker bridge.
+- Paired with `app-catalog-felhom.eu` adding `scheme=https` + `serverstransport=insecure-skip-verify@file`
+  to the crafty service. Tests: `TestServersTransports` + the YAML-parse matrix.
+
 ### v0.82.0 — FileBrowser sync no longer bounces the file UI on no-op; drop dead restic binary (2026-06-24)
 - **F2 — gate the FileBrowser recreate on an actual change.** `syncFileBrowserMounts` (`internal/web/handlers.go`)
   previously ran `docker compose up -d --force-recreate --remove-orphans` **unconditionally**, so every