Refresh TLSStore every loop so newly-issued certs get served

Shipped

June 8, 2026 at 2:44 AM UTC

Author

Kamo

Commit

d84bcc8

update_tls_store() only ran at startup and on shared-storage imports, so a cert freshly issued by cert-manager (HTTP-01) was Ready with a tls-* secret but never added to the TLSStore until the next auto-cert restart — Traefik kept serving the default self-signed cert for it (e.g. login.sign.pink). Call update_tls_store() each loop, with a cert-set signature guard so it only re-applies (and triggers a Traefik TLS reload) when the set changed.