The ingress pointed at scottyah-tls, a secret hand-copied between
namespaces and absent from this one, so Traefik fell back to a
self-signed certificate. That is invisible behind Cloudflare until the
SSL mode is set to Full (strict), which then fails with a 526.
Issue into the namespace over DNS-01 instead. Nothing to copy, and the
renewal is no longer a thing anyone has to remember.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The directory, the repo and the hostname are all fit; the module path,
the image, the namespace and the data file were still tracker. Nothing
is deployed yet, so this is free now and would not be later.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The workout, the protein, the calories, the water, and three lines of
gratitude. One page per day, a card of seventy-five tiles that fill by
how many of the five landed, and a missed day left as a gap rather than
a reset.
Single Go binary with no dependencies. The log is one JSON file on a
mounted volume, written atomically and never silently replaced when it
fails to parse, since it is the one thing here that cannot be recreated.
Auth is Traefik basic auth at the ingress; the app has no login of its
own, so every POST checks Sec-Fetch-Site to stop another origin posting
with those credentials.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
