v0.83.0: Traefik scoped insecure-skip-verify serversTransport for self-signed HTTPS backends (fixes crafty 502)

controller/internal/stacks/infra.go

@@ -43,6 +43,13 @@ func (m *Manager) EnsureBaseStack() error {
 		errs = append(errs, fmt.Sprintf("traefik: %v", err))
 	}
 
+	// Write the backend-transports dynamic file. Done OUTSIDE ensureTraefik (which early-returns when
+	// traefik is already running) so a self-heal tick on an established node still materializes it.
+	// The traefik file watcher hot-loads it — no restart needed.
+	if err := m.ensureServersTransports(traefikDir); err != nil {
+		errs = append(errs, fmt.Sprintf("servers-transports: %v", err))
+	}
+
 	// Wire the controller's OWN dashboard route into traefik. Unlike filebrowser (which self-registers
 	// via Docker labels + network membership baked into its compose), the controller is started by the
 	// golden bootstrap before traefik-public exists and the v2 bootstrap carries no domain — so it can't
@@ -147,6 +154,26 @@ func (m *Manager) ensureFileBrowser(dir string) error {
 	return m.composeUp(dir)
 }
 
+// ensureServersTransports writes the traefik file-provider dynamic config defining named backend
+// transports (the insecure-skip-verify transport for self-signed HTTPS backends like Crafty). Like
+// wireController, it writes only when the content changes so the traefik file watcher doesn't reload
+// on every self-heal tick. Idempotent and cheap.
+func (m *Manager) ensureServersTransports(traefikDir string) error {
+	dynDir := filepath.Join(traefikDir, "dynamic")
+	if err := os.MkdirAll(dynDir, 0o755); err != nil {
+		return fmt.Errorf("mkdir dynamic: %w", err)
+	}
+	path := filepath.Join(dynDir, "serverstransports.yml")
+	want := infra.RenderServersTransports()
+	if cur, err := os.ReadFile(path); err != nil || string(cur) != want {
+		if err := os.WriteFile(path, []byte(want), 0o644); err != nil {
+			return fmt.Errorf("write servers-transports: %w", err)
+		}
+		m.logger.Printf("[INFO] [infra] wrote backend transports → %s (%s)", path, infra.ServersTransportInsecure)
+	}
+	return nil
+}
+
 // controllerContainer is the fixed name of the in-guest controller container (set by the golden
 // bootstrap `docker run --name`). traefik resolves it by this name once both share traefik-public.
 const controllerContainer = "felhom-controller"