claude-botandClaude Opus 5.5
adbfd3bfc6
The public edge is proxy-1/proxy-2; proxy.renner.uno has not pointed at netbird.renner.uno since the netcup fleet took over. The proxy that kept running on the management host has served nothing since the controller moved every service to TLS passthrough (2026-09-07): passthrough routes live on the proxy's own :443 listener, while the host's Traefik forwards HostSNI(*) to its :8443 main listener, which answers "unknown domain". Its watchdog therefore failed every probe round and ran `docker restart` every ~3 minutes since 2026-09-07 12:53 (last healthy round). Each restart registered a fresh proxy peer and pushed a network-map update to every peer in the mesh — ~10 stale proxy-* identities per ingress peer and a map update every 1-2 minutes. - netbird-server: drop the proxy service, its Traefik TCP passthrough, proxy.env and the proxy vars; `compose up --remove-orphans` removes the container, and one-off tasks stop/remove both watchdogs and delete the proxy volumes, config and state. - install-netbird-server.yml no longer applies netbird-proxy-watchdog; its pipeline no longer triggers on that role. - Comments that described the management host as a cluster member now describe the proxy hosts only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>