# Runbook

## Common tasks

### Start the load balancer

```bash
docker compose up -d
```

### Stop the load balancer

```bash
docker compose down
```

### Update backend targets

1. Edit `config/dynamic/tcp-services.yml`.
2. Run `docker compose config` to catch Compose-level errors.
3. Watch Traefik logs:

```bash
docker compose logs -f traefik
```

Dynamic file-provider changes are watched by Traefik.

## Troubleshooting

### Container is unhealthy

Check container status and logs:

```bash
docker compose ps
docker compose logs traefik
```

Confirm that `config/traefik.yml` is mounted and that the ping entrypoint is enabled.

### Clients cannot connect

Check that the host is listening on `443/tcp`, firewall rules allow inbound traffic, and backend IP addresses are reachable from the Traefik container. For services on the Docker host, configure backends as `host.docker.internal:PORT`.

### Wrong certificate is presented

Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in `config/dynamic/tcp-services.yml`.

## Rollback

Stop the Compose stack:

```bash
docker compose down
```

Revert the deployment commit or restore the previous load-balancer configuration.