From 8dab25472988b4b71e706d99f577b8d54577152a Mon Sep 17 00:00:00 2001 From: Lucas Rayan Date: Sun, 2 Aug 2026 19:39:38 -0300 Subject: [PATCH] #23: pin Traefik to the proxy network by name, not by variable The site returned 504 on every request while the web container was healthy and Next was serving. The container sits on three networks - backend, proxy, and the per-app network Coolify adds - and the label meant to tell Traefik which one to use reached it as the literal text '${COOLIFY_PROXY_NETWORK:-coolify}'. Coolify escapes $ to $$ when it rewrites compose labels, so the variable was never interpolated, the label matched no network, and Traefik fell back to picking one itself. Choosing 'backend' - internal: true, no route to the proxy - produces exactly this: a gateway timeout in front of a working app. The label has been wrong since it was added; container recreation during the last deploy changed which network Traefik happened to pick and turned a latent fault into an outage. Co-Authored-By: Claude Opus 5 --- docker-compose.yaml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index d7dae5a..edb04bf 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -300,9 +300,18 @@ services: protocols: { condition: service_healthy } labels: - traefik.enable=true - # With the service on two networks Traefik may route via the wrong one - # and return 504. This pins it to the proxy network. - - traefik.docker.network=${COOLIFY_PROXY_NETWORK:-coolify} + # Pins Traefik to the proxy network. The container sits on three - + # backend, proxy, and the per-app network Coolify adds - and with no + # usable value here Traefik picks one arbitrarily. When it picks + # "backend" (internal: true, no route to the proxy) every request ends in + # a 504 while the container itself is perfectly healthy. + # + # The name is written out rather than taken from ${COOLIFY_PROXY_NETWORK} + # because Coolify escapes $ to $$ when it rewrites labels: the variable + # reached Traefik as the literal text "${COOLIFY_PROXY_NETWORK:-coolify}", + # which matches no network, so this label silently did nothing. Change it + # here if your proxy network is not called "coolify". + - traefik.docker.network=coolify # Webmail (/user/*) - traefik.http.routers.lm-web.rule=Host(`${WEBMAIL_HOST}`) - traefik.http.routers.lm-web.tls.certresolver=letsencrypt