v0.83.0: Traefik scoped insecure-skip-verify serversTransport for self-signed HTTPS backends (fixes crafty 502)

controller/internal/infra/infra.go

@@ -210,6 +210,29 @@ http:
 `, domain, tlsBlock)
 }
 
+// ServersTransportInsecure is the name of the traefik dynamic serversTransport that skips backend TLS
+// verification. App services reference it by `<name>@file` (cross-provider: a docker-provider service
+// pointing at a file-provider transport). It exists for backends that serve their OWN self-signed TLS
+// on the internal docker bridge (e.g. Crafty on :8443) — there is no CA to verify a per-container
+// self-signed cert against, and the hop never leaves the host's docker network. Verification stays the
+// default (ON) for every other backend; only services that explicitly add the label opt out.
+const ServersTransportInsecure = "insecure-skip-verify"
+
+// RenderServersTransports returns the traefik file-provider dynamic config defining the named backend
+// transports. Written to its OWN file under /etc/traefik/dynamic/ (NOT folded into the controller
+// route) so the two concerns stay independent. Static and constant — no per-customer input.
+func RenderServersTransports() string {
+	return fmt.Sprintf(`# Traefik dynamic config — backend transports. Managed by felhom-controller.
+# WARNING: auto-generated at base-infra bring-up. Manual edits are overwritten.
+# %s: for backends that serve their own self-signed TLS on the internal docker bridge
+# (e.g. Crafty on :8443). Backend verification stays ON for all other backends.
+http:
+  serversTransports:
+    %s:
+      insecureSkipVerify: true
+`, ServersTransportInsecure, ServersTransportInsecure)
+}
+
 // RenderFileBrowserConfig returns a FileBrowser Quantum config.yaml with one source per registered
 // storage path (each a named sidebar entry). Empty paths → a single default /srv source. Ported
 // verbatim from internal/web/handlers.go.