The traefik gateway terminates TLS for ghp.unkin.net and forwards
cleartext to the ghp Service port 80 -> container :8080. But :8080 was
GHP_SERVER_HTTP_LISTEN, ghp's http->https 308 REDIRECT listener, so ghp
bounced every request back to https, which the gateway forwarded to
:8080 again: an infinite ghp.unkin.net -> ghp.unkin.net 308 loop.
Per ghp source (internal/server/server.go Run/serveTLS/servePlain,
redirect.go), the app is served on either GHP_SERVER_LISTEN (plain, full
handler incl. mgmt UI + API) OR GHP_SERVER_HTTPS_LISTEN (own TLS) - it is
strictly either/or: any non-empty https_listen sets hasTLS and runs
serveTLS, in which GHP_SERVER_LISTEN is ignored and http_listen only ever
redirects. To serve cleartext on :8080 behind the TLS-terminating
gateway, ghp must run in plain mode:
- configmap: drop GHP_SERVER_HTTPS_LISTEN + GHP_SERVER_HTTP_LISTEN; set
GHP_SERVER_LISTEN ":8080" so :8080 SERVES the app; add
GHP_SERVER_TRUST_PROXY_HEADERS so ghp trusts the gateway's
X-Forwarded-*/Forwarded for scheme/host.
- deployment + vmservicescrape: the metrics server only wraps TLS when
hasTLS is true, so in plain mode it is cleartext - switch the /metrics
probes and the scrape from HTTPS/https to HTTP/http.
Service, HTTPRoute and Gateway are unchanged.
unkin-agent