kevinveenbirkenbachandClaude Opus 5.5 2597ce1b90 fix(ca_injected): read an application's own TLS on its canonical domain ...

Asked by application id, lookup('tls') aligns the domain to the vhost in `domain`. sys-svc-cdn reloads the compose handlers inside every sibling of the vhost loop, so a handler flushed after the loop still saw the application's onion sibling there: on prometheus' second stack deploy (the MCP adapter rebuild) ca_injected answered False, the swarm CA override was skipped and compose_file_args dropped it from docker stack deploy. Blackbox lost the CA mount and the docs healthz probe failed with an unknown authority (API#1, Jenkins#1), and the spec flip recreated every task at once, so the sso-proxy reached central redis before its sidecar registered and the converge gate failed on NOAUTH (OnlyOffice#1, Nextcloud#1, GitLab#1, Mattermost#1; run 40131272595).

The CA mount belongs to the containers, not to a vhost, so the own-TLS check now asks with the canonical domain, which no alignment touches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-25 08:44:25 +01:00

..

action

Merge branch 'feature/updater' into feature/store-i18n

2026-10-23 17:32:32 +02:00

filter

Merge branch 'feature/updater' into feature/store-i18n

2026-10-23 22:24:51 +02:00

lookup

fix(ca_injected): read an application's own TLS on its canonical domain

2026-10-25 08:44:25 +01:00

__init__.py

…