Share subdomain var in Traefik routers; add clone auth hints #7

Merged

MHE merged 3 commits from audit-repo-completeness-certs-dumper-image into main

2026-10-31 15:46:10 +01:00

MHE commented

2026-10-31 15:45:03 +01:00

Owner

What changed

Traefik router templates

Each conf.d template declares its subdomain once in a new VARIABLES section ({{ $sub := "..." }}). All Host() rules use {{ $sub }} instead of repeating the label for TRAEFIK_DOMAIN and TRAEFIK_DOMAIN_1..4.
traefik-wildcard-cert.yaml and template follow the same shape. Rendered Host rules keep the same intent.
.openso/rules/30-traefik.md documents the pattern for new router files.
Whitespace inside {{ env "..." }} is normalized.

Clone scripts (run.sh, get-folder.sh)

Clones run with GIT_TERMINAL_PROMPT=0, so they fail fast instead of hanging on a credential prompt.
On an HTTPS clone failure, log_repo_auth_hint prints one-time credential setup commands. The scripts still store no token.
README and 20-scripts.md document the same behavior.

Housekeeping

Removed the local plan file .cursor/plans/traefik_ci_image_handoff.plan.md.
.gitignore ignores .cursor/ so local plans and session files stay out of commits.

Why

Repeating the subdomain label in every Host() made router files easy to get out of sync; one variable per file fixes that. The clone changes turn a missing private-repo credential into an actionable error instead of a hang or an opaque failure. The plan was local handoff notes, not project documentation.

## What changed **Traefik router templates** - Each `conf.d` template declares its subdomain once in a new `VARIABLES` section (`{{ $sub := "..." }}`). All `Host()` rules use `{{ $sub }}` instead of repeating the label for `TRAEFIK_DOMAIN` and `TRAEFIK_DOMAIN_1..4`. - `traefik-wildcard-cert.yaml` and `template` follow the same shape. Rendered Host rules keep the same intent. - `.openso/rules/30-traefik.md` documents the pattern for new router files. - Whitespace inside `{{ env "..." }}` is normalized. **Clone scripts (`run.sh`, `get-folder.sh`)** - Clones run with `GIT_TERMINAL_PROMPT=0`, so they fail fast instead of hanging on a credential prompt. - On an HTTPS clone failure, `log_repo_auth_hint` prints one-time credential setup commands. The scripts still store no token. - README and `20-scripts.md` document the same behavior. **Housekeeping** - Removed the local plan file `.cursor/plans/traefik_ci_image_handoff.plan.md`. - `.gitignore` ignores `.cursor/` so local plans and session files stay out of commits. ## Why Repeating the subdomain label in every `Host()` made router files easy to get out of sync; one variable per file fixes that. The clone changes turn a missing private-repo credential into an actionable error instead of a hang or an opaque failure. The plan was local handoff notes, not project documentation.

MHE added 3 commits

2026-10-31 15:45:03 +01:00

Ignore .cursor/ and remove tracked traefik CI plan 5e2412b078

Add HTTPS credential hints on clone failure in run and get-folder 4b66f26565

Use shared $sub variable for Traefik router subdomains

ci / compose (pull_request) Successful in 13s

Details

ci / shellcheck (pull_request) Successful in 6s

Details

ci / conventions (pull_request) Successful in 2s

Details

ci / image (pull_request) Successful in 1s