# Runbook

## Common tasks

### Start the load balancer

```bash
docker compose up -d
```

### Stop the load balancer

```bash
docker compose down
```

### Update backend targets

1. Edit `config/dynamic/tcp-services.yml`.
2. Run `docker compose config` to catch Compose-level errors.
3. Watch Traefik logs:

```bash
docker compose logs -f traefik
```

Dynamic file-provider changes are watched by Traefik.

## Troubleshooting

### Container is unhealthy

Check container status and logs:

```bash
docker compose ps
docker compose logs traefik
```

Confirm that `config/traefik.yml` is mounted and that the ping entrypoint is enabled.

### Clients cannot connect

Check that the host is listening on `80/tcp` and `443/tcp`, firewall rules allow inbound traffic, and backend IP addresses are reachable from Traefik. For services bound to host loopback, configure backends as `127.0.0.1:PORT`.

### Certificate HTTP-01 challenge fails

Check that port `80/tcp` is reachable from the internet and that the matching HTTP service points to the local backend that handles ACME challenge paths.

### Wrong certificate is presented

Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in `config/dynamic/tcp-services.yml`.

## Rollback

Stop the Compose stack:

```bash
docker compose down
```

Revert the deployment commit or restore the previous load-balancer configuration.