jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(ci): staging failure dump includes Traefik's ACME log lines and the certificate names it holds #101

Merged
jfraeys merged 1 commit from jfraeys/fix/staging-diag-traefik-acme into main 2026-10-13 21:07:41 -04:00
Conversation 0 Commits 1 Files changed 1 +13 -2
jfraeys commented 2026-10-13 11:40:30 -04:00
Owner
Copy link

Staging run 291 (commit 1e9a895) failed at 'headscale : Wait for Traefik's real certificate': 40 retries over about 7 minutes and vpn.jfraeys.com never appeared in Traefik's acme.json. Earlier green runs (377, 557, 280) got that certificate in about 20 seconds. The failure dump showed Traefik healthy but nothing about ACME, and the nodes are destroyed afterwards, so the cause cannot be read from the log.

What I could rule out from outside: the Cloudflare zone holds no leftover _acme-challenge.vpn record (names and counts only), and the vpn A/AAAA records are DNS-only as expected. The cause is still unknown (candidate: a transient Let's Encrypt staging or Cloudflare API problem; a re-run, task 612, was already in progress).

This makes the next occurrence self-explanatory. The dump now starts with Traefik's last 40 ACME/certificate/DNS/error log lines and the certificate names it holds from acme.json (names only, never certificate or key content); the Docker journal part is cut from 30 to 12 lines (it was mostly sbJoin noise) and the output window grows from 80 to 140 lines.

Tested: sh -n on the generated diagnostics script, its Python part against a fake acme.json (prints only names), shellcheck -S error clean (docker). Not exercised on a real node: that needs a failing deploy.

🤖 Generated with Claude Code

Staging run 291 (commit 1e9a895) failed at 'headscale : Wait for Traefik's real certificate': 40 retries over about 7 minutes and `vpn.jfraeys.com` never appeared in Traefik's acme.json. Earlier green runs (377, 557, 280) got that certificate in about 20 seconds. The failure dump showed Traefik healthy but nothing about ACME, and the nodes are destroyed afterwards, so the cause cannot be read from the log. What I could rule out from outside: the Cloudflare zone holds no leftover `_acme-challenge.vpn` record (names and counts only), and the `vpn` A/AAAA records are DNS-only as expected. The cause is still unknown (candidate: a transient Let's Encrypt staging or Cloudflare API problem; a re-run, task 612, was already in progress). This makes the next occurrence self-explanatory. The dump now starts with Traefik's last 40 ACME/certificate/DNS/error log lines and the certificate names it holds from acme.json (names only, never certificate or key content); the Docker journal part is cut from 30 to 12 lines (it was mostly sbJoin noise) and the output window grows from 80 to 140 lines. Tested: sh -n on the generated diagnostics script, its Python part against a fake acme.json (prints only names), shellcheck -S error clean (docker). Not exercised on a real node: that needs a failing deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(ci): staging failure dump includes Traefik's ACME log lines and the certificate names it holds
All checks were successful
Lint / lint (pull_request) Successful in 1m48s
Details
Secret scan / scan (pull_request) Successful in 16s
Details
f9fccad181
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!101
No description provided.