fix(traefik): exclude private keys by suffix so -key hostnames are served

[paolomainardi]

User description

🤖 This was written by an AI agent on behalf of @paolomainardi.

Closes #163.

What changes

The certificate scan in build/traefik/entrypoint.sh excluded private keys with grep -v "\-key", a substring match on the whole path. Any certificate whose hostname contains -key (my-keycloak.spark.loc, api-keys.spark.loc) was dropped with the keys, so Traefik never served it while certs list showed it installed.

The filter is now find's own suffix match: ! -name "*-key.pem" ! -name "*-key.crt". No grep, so the stray \ before - warning GNU grep printed on every scan is gone too. test/test-certs.sh, which mirrors the scan, gets the same line.

Verification

Run in a throwaway container from the current http-proxy-traefik image with the fixed entrypoint mounted over /ep.sh, against a scratch directory holding my-keycloak.spark.loc, audiolyzer.spark.loc and an other.crt pair:

tls:
  certificates:
    - certFile: /traefik/certs/other.crt
      keyFile: /traefik/certs/other-key.crt
    - certFile: /traefik/certs/audiolyzer.spark.loc.pem
      keyFile: /traefik/certs/audiolyzer.spark.loc-key.pem
    - certFile: /traefik/certs/my-keycloak.spark.loc.pem
      keyFile: /traefik/certs/my-keycloak.spark.loc-key.pem

test/test.sh gains the same case: a my-keycloak.spark.loc pair through the scan, asserting the certificate is referenced exactly once. shellcheck -s sh on the entrypoint is clean.

Takes effect

This is a container change, so a machine sees it after the images are rebuilt on main and pulled with spark-http-proxy upgrade.

---

PR Type

Bug fix, Tests, Documentation

---

Description

• Match private keys by filename suffix

• Serve certificates containing -key in hostnames

• Add regression coverage for certificate scanning

• Document the certificate filtering fix

---

Diagram Walkthrough

flowchart LR
  scan["Scan PEM and CRT files"]
  filter["Exclude only private-key suffixes"]
  config["Generate Traefik TLS configuration"]
  serve["Serve certificates with -key hostnames"]
  scan -- "find certificates" --> filter
  filter -- "retain valid certificates" --> config
  config -- "configure Traefik" --> serve

Loading

File Walkthrough

	Relevant files
Bug fix	entrypoint.sh Correct Traefik private-key certificate filtering                build/traefik/entrypoint.sh Replaces substring filtering with find suffix exclusions Excludes only *-key.pem and *-key.crt Preserves certificates containing -key in hostnames +4/-2
Tests	test-certs.sh Align certificate test filtering with entrypoint                  test/test-certs.sh Mirrors suffix-based filtering in certificate tests Supports both PEM and CRT key filenames +1/-1      test.sh Test certificates with `-key` hostnames                                    test/test.sh Adds a my-keycloak.spark.loc regression case Verifies the certificate appears exactly once Ensures its private key is not treated as a certificate +24/-0
Documentation	CHANGELOG.md Document corrected certificate suffix filtering                    CHANGELOG.md Documents serving certificates containing -key References issue #163 +1/-0

---

---

Assisted-by: pr-agent/gpt-5.6-sol

[sparkfabrik-ai-bot]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ✅ 163 - Fully compliant Compliant requirements: Exclude private-key files by matching the -key.pem or -key.crt suffix. Continue serving certificates whose hostname contains -key. Avoid the GNU grep stray \ before - warning.

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

---

Assisted-by: pr-agent/gpt-5.6-sol

[sparkfabrik-ai-bot]

PR Code Suggestions ✨

No code suggestions found for the PR.