# Runbook

## Common tasks

### Start the load balancer

```bash
docker compose up -d
```

### Stop the load balancer

```bash
docker compose down
```

### Update backend targets

1. Edit the relevant site file under `config/dynamic/`.
2. Run `docker compose config` to catch Compose-level errors.
3. Watch Traefik logs:

```bash
docker compose logs -f traefik
```

Dynamic file-provider changes are watched by Traefik.

## Troubleshooting

### Container is unhealthy

Check container status and logs:

```bash
docker compose ps
docker compose logs traefik
```

Confirm that `config/traefik.yml` is mounted and that the ping entrypoint is enabled.

### Backend is unhealthy

Check Traefik logs and verify that the local backend ports respond from the host:

```bash
curl -H 'Host: lab.younerd.org' http://127.0.0.1:8080/
openssl s_client -connect 127.0.0.1:8443 -servername lab.younerd.org
```

Repeat with the hostname and ports from the relevant file under `config/dynamic/`.

### Clients cannot connect

Check that the host is listening on `80/tcp` and `443/tcp`, firewall rules allow inbound traffic, and backend IP addresses are reachable from Traefik. For services bound to host loopback, configure backends as `127.0.0.1:PORT`.

### Certificate HTTP-01 challenge fails

Check that port `80/tcp` is reachable from the internet and that the matching HTTP service points to the local backend that handles ACME challenge paths.

### Wrong certificate is presented

Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in the relevant file under `config/dynamic/`.

## Rollback

Stop the Compose stack:

```bash
docker compose down
```

Revert the deployment commit or restore the previous load-balancer configuration.