From 5a5718a2d33977e2cd2fdd3a787c3209c78c1c80 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Thu, 16 Jul 2026 23:04:00 -0700
Subject: [PATCH] traefik: fix update order for host-mode/VRRP services
 (start-first -> stop-first)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reverse-proxy publishes host-mode ports (80/443/1883/5201/5431) — start-first
can never bind while the old task holds the ports, deadlocking every rolling
update. keepalived master/backup run VRRP on the host network — concurrent
old+new speakers with the same router-id risk VIP flapping. Both now use
stop-first (global mode + parallelism=1 + VIP failover keeps ingress up).
Stateless helpers (whoami, speedtest, iperf3, certs-dumper) keep start-first.

Step 1 of Tier 0/1 pipeline inclusion (prep for removing traefik/woodpecker
from the bootstrap manual-deploy guard).
---
 traefik.yaml | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/traefik.yaml b/traefik.yaml
index b9f71f0..cd72834 100644
--- a/traefik.yaml
+++ b/traefik.yaml
@@ -20,16 +20,18 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP — two concurrent keepalived speakers with the
+      # same router-id would fight over the VIP. Never run old+new simultaneously.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   keepalived-backup:
     environment:
@@ -51,16 +53,17 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP (see keepalived-master)
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   reverse-proxy:
     image: public.ecr.aws/docker/library/traefik:latest
@@ -128,16 +131,20 @@ services:
         - traefik.http.routers.traefik.middlewares=forwardAuth-authentik@file, crowdsec@file
       resources:
         limits: {cpus: '4', memory: 512M}
+      # stop-first: host-mode published ports (80/443/1883/5201/5431) — a start-first
+      # replacement task can never bind while the old task holds the ports, so
+      # start-first would deadlock/rollback every update. Global mode + parallelism 1
+      # means only one node is briefly down; keepalived VIP + remaining nodes cover it.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   traefik-certs-dumper:
     image: ghcr.io/ldez/traefik-certs-dumper:v2.10.0