From 802a4d1ba0f57d7b6beeb253d6170b2e5961c0ad Mon Sep 17 00:00:00 2001
From: Kelin <kelin@example.com>
Date: Sat, 7 Feb 2026 16:24:57 -0500
Subject: [PATCH] Fix multiserver deployment: domain in docker-provider and
 auto-disable remote Traefik

- Fix missing domain in docker provider defaultRule (use DOMAIN or DUCKDNS_DOMAIN)
- Add disable_traefik_on_remote_services() to strip routing labels from remote services
- Call disable function automatically during remote server deployment (Step 5.5)
- Remote services now properly accessed through core Traefik via docker provider
- Prevents errors: middleware/certresolver not found on remote Traefik

Resolves Traefik errors on remote servers where services had labels for
SSL/auth that only exist on core server.
---
 scripts/common.sh     |  5 ++++-
 scripts/ez-homelab.sh | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/scripts/common.sh b/scripts/common.sh
index f59edd5..1ea0d10 100644
--- a/scripts/common.sh
+++ b/scripts/common.sh
@@ -245,6 +245,9 @@ generate_traefik_provider_config() {
         return 1
     fi
     
+    # Get domain from environment or use a default
+    local domain="${DOMAIN:-${DUCKDNS_DOMAIN}}"
+    
     cat > "$output_file" <<EOF
 # Traefik Docker Provider for Remote Server: $server_hostname
 # Auto-generated by EZ-Homelab
@@ -262,7 +265,7 @@ providers:
       key: /shared-ca/key.pem
       insecureSkipVerify: false
     # Server-specific constraints
-    defaultRule: "Host(\`{{ normalize .Name }}.${DUCKDNS_DOMAIN}\`)"
+    defaultRule: "Host(\`{{ normalize .Name }}.${domain}\`)"
 EOF
     
     log_success "Generated Traefik provider config: $output_file"
diff --git a/scripts/ez-homelab.sh b/scripts/ez-homelab.sh
index 8df9677..1eaf643 100755
--- a/scripts/ez-homelab.sh
+++ b/scripts/ez-homelab.sh
@@ -1703,6 +1703,11 @@ deploy_remote_server() {
     copy_all_stacks_for_remote
     echo ""
     
+    # Step 5.5: Disable Traefik on remote services (accessed via core)
+    log_info "Step 5.5: Configuring remote services for core Traefik access..."
+    disable_traefik_on_remote_services
+    echo ""
+    
     # Step 6: Deploy Dockge
     log_info "Step 6: Deploying Dockge..."
     deploy_dockge
@@ -1886,6 +1891,39 @@ deploy_sablier_stack() {
     log_success "Sablier stack deployed at $sablier_dir"
 }
 
+# Disable Traefik routing on remote server services
+# Remote services are accessed through core Traefik via docker provider
+disable_traefik_on_remote_services() {
+    debug_log "Disabling Traefik routing on remote server services"
+    
+    log_info "Configuring services for remote server access..."
+    
+    # Stacks that should NOT route through local Traefik
+    local config_files=(
+        "/opt/stacks/sablier/docker-compose.yml"
+        "/opt/stacks/infrastructure/docker-compose.yml"
+        "/opt/dockge/docker-compose.yml"
+    )
+    
+    local modified_count=0
+    for config_file in "${config_files[@]}"; do
+        if [ -f "$config_file" ]; then
+            # Disable traefik.enable on all services
+            if sed -i "s/'traefik.enable=true'/'traefik.enable=false'/g" "$config_file" 2>/dev/null; then
+                modified_count=$((modified_count + 1))
+                debug_log "Disabled Traefik on $(basename $(dirname $config_file))"
+            fi
+        fi
+    done
+    
+    if [ $modified_count -gt 0 ]; then
+        log_success "Disabled local Traefik routing on $modified_count service stacks"
+        log_info "Services will be accessed through core Traefik at https://service.${DOMAIN}"
+    else
+        log_warning "No service configurations were modified"
+    fi
+}
+
 # Copy all stacks for remote server (except core)
 copy_all_stacks_for_remote() {
     debug_log "Copying all stacks for remote server"