v0.83.0: Traefik scoped insecure-skip-verify serversTransport for self-signed HTTPS backends (fixes crafty 502)

controller/internal/infra/infra.go

@@ -210,6 +210,29 @@ http:
 `, domain, tlsBlock)
 }
 
+// ServersTransportInsecure is the name of the traefik dynamic serversTransport that skips backend TLS
+// verification. App services reference it by `<name>@file` (cross-provider: a docker-provider service
+// pointing at a file-provider transport). It exists for backends that serve their OWN self-signed TLS
+// on the internal docker bridge (e.g. Crafty on :8443) — there is no CA to verify a per-container
+// self-signed cert against, and the hop never leaves the host's docker network. Verification stays the
+// default (ON) for every other backend; only services that explicitly add the label opt out.
+const ServersTransportInsecure = "insecure-skip-verify"
+
+// RenderServersTransports returns the traefik file-provider dynamic config defining the named backend
+// transports. Written to its OWN file under /etc/traefik/dynamic/ (NOT folded into the controller
+// route) so the two concerns stay independent. Static and constant — no per-customer input.
+func RenderServersTransports() string {
+	return fmt.Sprintf(`# Traefik dynamic config — backend transports. Managed by felhom-controller.
+# WARNING: auto-generated at base-infra bring-up. Manual edits are overwritten.
+# %s: for backends that serve their own self-signed TLS on the internal docker bridge
+# (e.g. Crafty on :8443). Backend verification stays ON for all other backends.
+http:
+  serversTransports:
+    %s:
+      insecureSkipVerify: true
+`, ServersTransportInsecure, ServersTransportInsecure)
+}
+
 // RenderFileBrowserConfig returns a FileBrowser Quantum config.yaml with one source per registered
 // storage path (each a named sidebar entry). Empty paths → a single default /srv source. Ported
 // verbatim from internal/web/handlers.go.

controller/internal/infra/infra_test.go

@@ -47,9 +47,26 @@ func allRendered(t *testing.T) []string {
 	out = append(out, RenderFileBrowserCompose("example.com", nil))
 	out = append(out, RenderFileBrowserCompose("example.com", []string{"      - /mnt/hdd_1:/srv/hdd_1"}))
 	out = append(out, RenderFileBrowserConfig(nil))
+	out = append(out, RenderServersTransports())
 	return out
 }
 
+func TestServersTransports(t *testing.T) {
+	s := RenderServersTransports()
+	// The named transport must be defined under http.serversTransports with insecureSkipVerify, so a
+	// docker-provider service can reference it as `<name>@file`.
+	if !strings.Contains(s, "serversTransports:") || !strings.Contains(s, ServersTransportInsecure+":") {
+		t.Errorf("named serversTransport %q missing:\n%s", ServersTransportInsecure, s)
+	}
+	if !strings.Contains(s, "insecureSkipVerify: true") {
+		t.Errorf("insecureSkipVerify not set on the named transport:\n%s", s)
+	}
+	var v any
+	if err := yaml.Unmarshal([]byte(s), &v); err != nil {
+		t.Fatalf("serversTransports config is not valid YAML: %v\n%s", err, s)
+	}
+}
+
 func TestNoLatestTagSurvives(t *testing.T) {
 	for _, c := range []string{TraefikImage, CloudflaredImage, FileBrowserImage} {
 		if strings.HasSuffix(c, ":latest") || !strings.Contains(c, ":") {