- Ya
- 12 Mei 2026, 03:23 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 2ae1c93
organize_by_root() was extracting only the first label and the last two labels from each Traefik-logged hostname. For the common two-level case (login.b11capital.com -> root b11capital.com, sub login) this round-trips correctly. But for deeper hosts like **************** it silently flattened to internal.kamocrm.com, so cert-manager never received a Certificate request for the actual hostname and SecurityService's HTTPS probe stayed in 'SSL not yet installed' indefinitely. Track the complete FQDN in the value set instead of a single subdomain label. The two-label root key is retained for log grouping; all downstream consumers (collect_fqdns_for_root, ensure_host_certificate) now see the real hostname. Apex domains continue to round-trip via {full -> {full}}. Trigger: gnosia.demo.kamocrm.com child org's DNS verified, all 10 CNAMEs resolved, but no Certificate resource ever appeared.