Traefik's service.serverstransport annotation expects the
<name>@<provider> form per upstream docs. The bare name silently
resolved to nothing for ClusterIP-with-selector and EndpointSlice
backends (pve, test-browser) so the default insecure=false transport
was used and TLS failed on the self-signed backend cert. file
appeared to work only because its ExternalName backend
(nas.renner.uno) has a hostname-valid cert and was never relying on
insecureSkipVerify in the first place.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The kubernetesIngress provider resolves the
traefik.ingress.kubernetes.io/service.serverstransport annotation as a
bare ServersTransport name in the same namespace as the Ingress — the
<ns>-<name>@kubernetescrd qualified form is for IngressRoute CRDs.
With the wrong form, Traefik silently fell back to the default
transport and returned 500 on the backend TLS handshake.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Each re-encrypts to a self-signed backend (NAS UI, PVE 8006, KasmWeb
Firefox 6901). Adds a shared apps/insecure-backend ServersTransport
with insecureSkipVerify, referenced from each Ingress via the
service.serversscheme / service.serverstransport annotation pair —
replacing the nginx backend-protocol HTTPS + proxy-ssl-verify off
pattern. test-browser drops its configuration-snippet (the
Authorization-header-strip workaround for the CrowdSec nginx fork's
HTTP/2 bug — Traefik does not have that bug).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two LAN-only Caddy hostnames absorbed into ingress-nginx:
* file.renner.uno -- new apps/file/ ExternalName Service +
Ingress, backend https://nas.renner.uno:7001 with
backend-protocol=HTTPS, proxy-ssl-verify=off. Same shape Caddy
used. file.renner.uno was the only "stale-by-name but still
serving 200" hostname after the migrated/dead audit, so it
needed a live K8s home before Caddy goes off.
* photos.renner.uno -- alias added to the existing apps/immich
Ingress (which was already serving immich.renner.uno and
immich.k.renner.uno). Caddy never had a route for photos --
instead the tofu CNAME on lxc_225 immich pointed it at the
Caddy VIP, where it was caught by the immich.renner.uno block.
Adding the alias here lets external-dns-unifi take ownership
of photos.renner.uno after the LXC's tofu ingress_cnames is
cleared in the companion commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7