# Traefik

## "No available server" after redeploy `[WC-SEL]`

If a Deployment was originally created without kustomize labels in its selector, re-deploying cannot fix it — `spec.selector` is immutable once set. The Service selector updates (it's mutable) but pods won't match it, leaving the Service with no endpoints.

**Symptom**: Traefik returns "No available server" even though pods are Running.

**Diagnosis**:
```bash
kubectl get endpoints <app> -n <namespace>
# shows <none> — pods aren't matching the service
kubectl get pods -n <namespace> --show-labels
# pod labels don't include app: <name> / managedBy: kustomize / partOf: wild-cloud
```

**Fix**: delete the Deployment and re-deploy:
```bash
kubectl delete deployment <name> -n <ns>
wild app deploy <app>
```

## Same-origin iframes

The global Traefik `security-headers` middleware sets `X-Frame-Options: SAMEORIGIN`. Apps that embed their own sub-pages in iframes (e.g. Etherpad's pad editor) work correctly with this setting.

`DENY` was the previous setting and broke same-origin iframes. If you see:
```
Blocked a frame with origin "https://..." from accessing a cross-origin frame
```
the app is likely creating a same-origin iframe that a stale `DENY` header is blocking. Verify the cluster's Traefik middleware is using `SAMEORIGIN`.

**Note**: route-level Traefik middlewares run before entrypoint middlewares on the response path. A per-app middleware cannot override the global one.

## TLS-terminating reverse proxy (DISABLE_HTTPS)

Some apps (e.g. Zulip) redirect port 80 → HTTPS internally. When Traefik terminates TLS and forwards plain HTTP, this causes an infinite redirect loop.

Set these env vars to disable the internal redirect and trust the forwarded proto:
```yaml
- name: DISABLE_HTTPS
  value: "true"
- name: LOADBALANCER_IPS
  value: "10.244.0.0/16"  # Kubernetes pod CIDR (Flannel default)
```

Also update liveness/readiness probes from HTTPS port 443 to HTTP port 80.