Fix Traefik routing/cert issues from access logs - #1108
Merged
Conversation
- hasecure: drop the bare-IP Host() alternative, which was causing Let's Encrypt to reject the bundled SAN cert request for 172.24.32.13 (RFC1918 private IP) on every renewal attempt - home-assistant: remove the leftover 9584 HA-MCP port mapping now that HA-MCP has been decommissioned and its container stopped - cerebro: add explicit loadbalancer port so Traefik stops erroring with "port is missing" on every provider poll - calibre-http: pin the redirect router to the calibre service so Traefik can resolve it instead of erroring on the service ambiguity with calibre-web-https Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Host()alternative — Let's Encrypt was rejecting the bundled SAN cert request because172.24.32.13is an RFC1918 private address, breaking renewal on every attempt.9584:9584/tcpport mapping in home-assistant's compose file now that HA-MCP has been decommissioned (repo-side stack removed in45ffe79, container stopped on the host).loadbalancer.server.portlabel — Traefik couldn't determine the port and logged"port is missing"on every provider poll.calibreservice — Traefik couldn't auto-resolve it since the container also exposescalibre-web-https, so the plain-HTTP→HTTPS redirect wasn't working.network_mode: host(needed for Matter/mDNS discovery on the LAN), so Traefik's Docker provider has no container network to detect an IP from. Replaced the no-optraefik.docker.networklabel + plainserver.portwith an explicitloadbalancer.server.urlpinned to the host IP (supported since Traefik 3.4, this repo runs 3.7.10), and dropped the same bare-IPHost()pattern as hasecure.All were identified from repeating errors/warnings in the Traefik container logs.
Test plan
docker compose -f home-assistant/docker-compose.yaml config --quiet— same pre-existing external-network warning as before edits, no new errorsdocker compose -f elk-stack/docker-compose.yaml config --quiet— cleandocker compose -f calibre/docker-compose.yaml config --quiet— cleandocker compose -f matter-hub/docker-compose.yaml config --quiet— clean🤖 Generated with Claude Code