fix track

README.md

@@ -1364,7 +1364,7 @@ php artisan site:maintenance --up
 ## Tests
 
 ```bash
-php artisan test    # 394 tests, 1128 aserciones
+php artisan test    # 391 tests, 1121 aserciones
 ```
 
 En cada push y cada pull request, [`.github/workflows/tests.yml`](.github/workflows/tests.yml)
@@ -1600,7 +1600,7 @@ docker compose -f docker-compose.test.yml run --rm test
 
 Levanta un Postgres en memoria, corre la suite entera contra él y lo tira. Es la
 comprobación que convierte «debería funcionar» en «funciona», y conviene hacerla
-antes del primer despliegue. **394 tests en verde contra Postgres 17.**
+antes del primer despliegue. **391 tests en verde contra Postgres 17.**
 
 Usa una etapa propia de la imagen: la de producción se construye con `--no-dev`
 y ahí no está ni el runner de tests.

docker-compose.yml

@@ -19,11 +19,17 @@
 # break generating it in the first place — `docker compose run --rm --no-deps
 # app php artisan key:generate --show` has to work before `APP_KEY` exists.
 #
-# `app` is not published on a host port: routing is Traefik, on the external
+# `app` is not published on a host port: it only joins the external
-# `dokploy-network`, terminating TLS before anything reaches this container —
+# `dokploy-network` so Dokploy's Traefik can reach it, and TLS is terminated
-# same reason `docker/Caddyfile` trusts `X-Forwarded-*` only from private
+# there before anything reaches this container — same reason
-# ranges. A manual deploy without Dokploy needs its own reverse proxy joined
+# `docker/Caddyfile` trusts `X-Forwarded-*` only from private ranges. The
-# to that network, or `app` added back to `default` with a published port.
+# domain itself is configured through Dokploy's own "Domains" tab, which
+# injects its own Traefik labels — don't also add them here, Traefik ends up
+# with two routers for the same Host() and picks one unpredictably.
+#
+# A manual deploy without Dokploy needs its own reverse proxy joined to that
+# network (with its own labels/config), or `app` added back to `default` with
+# a published port.
 #
 # The web container is the only one that migrates, so a deploy runs them once
 # rather than once per replica.
@@ -126,19 +132,12 @@ services:
     networks:
       - dokploy-network
       - default
-    labels:
+
-      - traefik.enable=true
+    # No Traefik labels here on purpose: the domain is configured through
-      - traefik.docker.network=dokploy-network
+    # Dokploy's own "Domains" tab for this app, which injects its own labels
-      - traefik.http.routers.landing-api-web.rule=Host(`landing-api.pireon.dev`)
+    # at deploy time. Hand-writing another set on top of those, for the same
-      - traefik.http.routers.landing-api-web.entrypoints=web
+    # Host(), gave Traefik two routers to choose between — it only broke once
-      - traefik.http.routers.landing-api-web.middlewares=redirect-to-https@file
+    # both existed together, which is exactly what happened.
-      - traefik.http.routers.landing-api-web.service=landing-api-web
-      - traefik.http.services.landing-api-web.loadbalancer.server.port=80
-      - traefik.http.routers.landing-api-websecure.rule=Host(`landing-api.pireon.dev`)
-      - traefik.http.routers.landing-api-websecure.entrypoints=websecure
-      - traefik.http.routers.landing-api-websecure.service=landing-api-websecure
-      - traefik.http.routers.landing-api-websecure.tls.certresolver=letsencrypt
-      - traefik.http.services.landing-api-websecure.loadbalancer.server.port=80
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://localhost/up"]
       interval: 30s