Traefik's service.serverstransport annotation expects the
<name>@<provider> form per upstream docs. The bare name silently
resolved to nothing for ClusterIP-with-selector and EndpointSlice
backends (pve, test-browser) so the default insecure=false transport
was used and TLS failed on the self-signed backend cert. file
appeared to work only because its ExternalName backend
(nas.renner.uno) has a hostname-valid cert and was never relying on
insecureSkipVerify in the first place.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7
38e54a748e