R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

controller/internal/stacks/filebrowser_restart_gate_test.go

@@ -77,9 +77,10 @@ func TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce(t *testing.T) {
 		return "", nil
 	}
 
-	// The gate's view of FileBrowser: run 1 was checked and public; a recreate makes run 2, off traefik-public.
+	// The gate's view of FileBrowser: run 1 was checked and public; a recreate makes run 2, off the files network (R-1281:
+	// felhom-files is traefik's only route to it; traefik-public before).
 	var mu sync.Mutex
-	nets := map[string]bool{"filebrowser@traefik-public": true, "felhom-controller@felhom-filebrowser": true}
+	nets := map[string]bool{"filebrowser@felhom-files": true, "traefik@felhom-files": true, "felhom-controller@felhom-filebrowser": true}
 	connected := make(chan string, 8)
 	m.fbStarted = func() string {
 		if recreated() {
@@ -108,9 +109,9 @@ func TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce(t *testing.T) {
 	}
 	os.Remove(marker)
 
-	// FileBrowser's restart: the recreate drops it from traefik-public; the gate must put run 2 back by itself.
+	// FileBrowser's restart: the recreate drops it from the files network; the gate must put run 2 back by itself.
 	mu.Lock()
-	delete(nets, "filebrowser@traefik-public")
+	delete(nets, "filebrowser@felhom-files")
 	mu.Unlock()
 	if err := m.RestartStack("filebrowser"); err != nil {
 		t.Fatalf("filebrowser restart: %v", err)
@@ -119,7 +120,7 @@ func TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce(t *testing.T) {
 	for {
 		select {
 		case c := <-connected:
-			if c == "filebrowser@traefik-public" {
+			if c == "filebrowser@felhom-files" {
 				if m.fbProbedRun != "run-2" {
 					t.Fatalf("published, but the checked run is %q, not the new run-2", m.fbProbedRun)
 				}