From 6eafac32749121bf64174083579ccdef7653b2fc Mon Sep 17 00:00:00 2001
From: bluebluesoda <300733005+bluebluesoda@users.noreply.github.com>
Date: Mon, 31 Aug 2026 07:26:32 +0000
Subject: [PATCH] fix(install): don't start traefik when IPv4 forwarding is off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

30-traefik.sh enabled traefik whenever the adopted net.traefik was true, even
on an IPv6-only box (net.v4_forward false). The domain proxy is only served
while BOTH v4 ingress and net.traefik are on, so traefik must stay installed
but DISABLED (no start, no boot autostart) when v4 forwarding is off, regardless
of the kept net.traefik value; re-enabling v4 later restores it. The start
branch is now gated on VPSMGR_V4_FORWARD first, matching the panel's own
ApplyTraefikState (V4Forward && Traefik).

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
---
 scripts/30-traefik.sh | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/scripts/30-traefik.sh b/scripts/30-traefik.sh
index e7795a5..62686cd 100755
--- a/scripts/30-traefik.sh
+++ b/scripts/30-traefik.sh
@@ -81,15 +81,30 @@ elif [[ -f /etc/vpsmgr/config.yaml ]]; then
   TRAEFIK_CFG=$(grep -E '^\s+traefik:' /etc/vpsmgr/config.yaml 2>/dev/null | awk -F': ' '{print $2}' | tr -d '"')
 fi
 
-# Traefik disabled (port 80/443 conflict forced off, or adopted config with
-# net.traefik false): install the binary but keep it DISABLED — the domain
-# proxy is not offered. Config is kept so a later `vps config set net.traefik
-# true` re-enables it. Also covers v4_forward off (IPv6-only box): no domain
-# proxy there either.
-if [[ "$TRAEFIK_CFG" == "false" || "$TRAEFIK_CFG" == "0" ]]; then
+# Effective v4 forwarding for this install. On a fresh install nothing forces
+# it off (default: enabled); on adoption 00-ip-ask.sh re-exports the recorded
+# config value so we keep the existing policy.
+V4ON=1
+case "${VPSMGR_V4_FORWARD:-1}" in
+  1|true|True)  V4ON=1 ;;
+  *)           V4ON=0 ;;
+esac
+
+# Traefik (the domain proxy) only ever runs while BOTH IPv4 ingress is on AND
+# net.traefik is on. With v4 forwarding OFF (an IPv6-only box) there is no
+# SSH/port DNAT and domains are not served, so traefik must be installed but
+# DISABLED (not started, no boot autostart) even if net.traefik is kept true —
+# re-enabling v4 later (`vps config set net.v4_forward true`) restores it.
+# The same disabling applies when net.traefik is false on its own (forced off
+# by a port 80/443 conflict, or an adopted config). Domain files are kept in
+# both cases so a later re-enable restores them.
+if [[ "$V4ON" -eq 0 ]]; then
+  systemctl disable --now traefik >/dev/null 2>&1 || true
+  log "v4 forwarding off — traefik installed but disabled (domains kept)"
+elif [[ "$TRAEFIK_CFG" == "false" || "$TRAEFIK_CFG" == "0" ]]; then
   systemctl disable --now traefik >/dev/null 2>&1 || true
   log "net.traefik false — traefik installed but disabled (not started/autostarted; domains kept)"
-elif [[ "$TRAEFIK_CFG" == "true" || "$TRAEFIK_CFG" == "1" || "${VPSMGR_V4_FORWARD:-1}" == "1" || "${VPSMGR_V4_FORWARD:-1}" == "true" ]]; then
+else
   systemctl enable --now traefik >/dev/null 2>&1 || die "cannot start traefik"
   sleep 1
   if systemctl is-active traefik >/dev/null 2>&1; then
@@ -98,9 +113,6 @@ elif [[ "$TRAEFIK_CFG" == "true" || "$TRAEFIK_CFG" == "1" || "${VPSMGR_V4_FORWAR
     systemctl status traefik --no-pager | tail -5
     die "traefik failed to start"
   fi
-else
-  systemctl disable --now traefik >/dev/null 2>&1 || true
-  log "v4 forwarding off — traefik installed but disabled (domains kept)"
 fi
 
 echo "[30] traefik ready"