68 lines
4.0 KiB
Markdown
68 lines
4.0 KiB
Markdown
# REPORT — Traefik scoped serversTransport for self-signed HTTPS backends (crafty 502 fix)
|
|
|
|
**Repo:** `felhom-controller` · **Version:** `v0.82.0` → **`v0.83.0`** · **Date:** 2026-06-26
|
|
**Commit:** `2d6df0f` · **Paired catalog commit:** `app-catalog-felhom.eu` `1216a8a`
|
|
**Deployed:** guest 9201 (`demo-felhom`) on `felhom-pve`, golden/bootstrap mechanism.
|
|
|
|
## Problem
|
|
The crafty-controller healthcheck fix (catalog `68ce009`) un-withheld its Traefik route, exposing a
|
|
pre-existing **502**: Traefik proxied **HTTP** to Crafty's **HTTPS-only** self-signed backend on `:8443`.
|
|
Crafty is the only catalog app with an HTTPS backend (all others serve plain HTTP, so Traefik's default
|
|
HTTP transport works for them). In Traefik v3 `insecureSkipVerify` cannot be set via Docker labels — it
|
|
must live in static/file config — so the fix necessarily touched the controller (which generates the
|
|
Traefik config), not just the catalog.
|
|
|
|
## Fix (Option B — scoped; verification stays ON by default)
|
|
A **named** serversTransport, opted into per-service — no global `insecureSkipVerify`.
|
|
|
|
- `internal/infra/infra.go` — new pure `RenderServersTransports()` + exported const
|
|
`ServersTransportInsecure = "insecure-skip-verify"`. Emits:
|
|
```yaml
|
|
http:
|
|
serversTransports:
|
|
insecure-skip-verify:
|
|
insecureSkipVerify: true
|
|
```
|
|
- `internal/stacks/infra.go` — new `ensureServersTransports(traefikDir)` writes
|
|
`dynamic/serverstransports.yml` (0644) idempotently (write-only-on-change, like `wireController`, so the
|
|
traefik file-watcher doesn't reload each self-heal tick). Called from `EnsureBaseStack` **outside**
|
|
`ensureTraefik` (which early-returns when traefik is already running) so an established node still
|
|
materializes the file on the next self-heal tick / restart; the file-provider `watch: true` hot-loads it
|
|
(no traefik restart).
|
|
- Catalog (`1216a8a`): crafty service gains `loadbalancer.server.scheme=https` +
|
|
`loadbalancer.serverstransport=insecure-skip-verify@file`.
|
|
- Tests: `TestServersTransports` (named transport + insecureSkipVerify + valid YAML) and the new render
|
|
added to the YAML-parse / no-`:latest` matrix. `go test ./internal/infra/... ./internal/stacks/...` green.
|
|
|
|
## Deploy
|
|
Commit → build+push `felhom-controller:0.83.0` on 192.168.0.180 → guest 9201 (`docker pull` →
|
|
`/etc/felhom-controller-image` → restart bootstrap svc). On controller startup, `EnsureBaseStack` wrote
|
|
`dynamic/serverstransports.yml` automatically (logged: `[infra] wrote backend transports → … (insecure-skip-verify)`)
|
|
— no manual file drop needed. Catalog sync (`POST /api/sync`) pulled the two labels; crafty recreated via
|
|
`POST /api/stacks/crafty-controller/update`.
|
|
|
|
## Verification (live, guest 9201)
|
|
| Check | Result |
|
|
|---|---|
|
|
| Dynamic file present + loaded | `/opt/docker/stacks/traefik/dynamic/serverstransports.yml` written, no traefik parse error |
|
|
| **A — public URL** | `https://minecraft.demo-felhom.eu` → **302** (was 502), via Cloudflare edge + in-guest Traefik |
|
|
| **A — Traefik backend** | access log: `302 … "crafty-controller@docker" "https://172.18.0.6:8443"` (before: `502 … "http://172.18.0.6:8443"`) |
|
|
| **B — other apps unaffected** | filebrowser (HTTP backend) still **200** via Traefik — scoped, no global change |
|
|
| **C — scoping proof** | **no** `insecureSkipVerify` in static `traefik.yml`; present ONLY in `dynamic/serverstransports.yml` |
|
|
| crafty health | `Up (healthy)`, dashboard state `running` |
|
|
|
|
## Deployed versions (`docker ps`)
|
|
```
|
|
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.83.0 Up (healthy)
|
|
crafty-controller registry.gitlab.com/crafty-controller/crafty-4:4.4.8 Up (healthy)
|
|
```
|
|
|
|
## Verification method
|
|
curl to the Cloudflare public edge + in-guest Traefik probe (`--resolve …:127.0.0.1`) + Traefik access
|
|
logs. (No browser tool used this run.)
|
|
|
|
## Observation (carry, not acted on)
|
|
Generalize a `backend_scheme`/`backend_tls` hint in `.felhom.yml` so future HTTPS-backend apps get the
|
|
`scheme=https` + `serverstransport=…@file` labels via the catalog convention rather than hand-added —
|
|
own task.
|