openship 0.4.7 → 0.5.0

package/dist/{chunk-UXWAVM4C.js → chunk-NXFIRK2Z.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   resolveEnvironment
-} from "./chunk-L2VOGB2X.js";
+} from "./chunk-KZOBYJUW.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -17,7 +17,7 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-FXTBHTWY.js";
+} from "./chunk-RB35YN3J.js";
 import {
   sq
 } from "./chunk-FPRHYBY2.js";
@@ -31,9 +31,10 @@ import {
   ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-R5BHFFAV.js";
+} from "./chunk-6PIYRG5I.js";
 import {
   waitForPortListening
 } from "./chunk-ILFETZOM.js";
@@ -42,12 +43,12 @@ import {
   EDGE_HOST_PATHS,
   OPENRESTY_DEFAULT_PATHS,
   detectOpenRestyPaths
-} from "./chunk-VFINNTUL.js";
+} from "./chunk-EAAGSQXN.js";
 import {
   buildEdgeImageRef,
   compareSemver,
   safeErrorMessage
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 
 // ../../packages/adapters/src/system/proxy/import/parse-utils.ts
 async function tryExec(executor, command) {
@@ -81,6 +82,24 @@ function extractBlocks(text, keyword) {
   }
   return blocks;
 }
+function collapseByHost(items, hostsOf, score) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = [...hostsOf(item)].sort().join(" ");
+    const bag = groups.get(key);
+    if (bag) bag.push(item);
+    else groups.set(key, [item]);
+  }
+  const kept = [];
+  const dropped = [];
+  for (const bag of groups.values()) {
+    let winner = bag[0];
+    for (const cand of bag) if (score(cand) > score(winner)) winner = cand;
+    kept.push(winner);
+    for (const loser of bag) if (loser !== winner) dropped.push(loser);
+  }
+  return { kept, dropped };
+}
 function sq3(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -121,7 +140,10 @@ function resolveProxyTarget(proxyPass, upstreams) {
   const host = authority.replace(/:\d+$/, "");
   if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
   const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
-  if (isIp || host === "localhost" || host.includes(".")) return { url: raw };
+  if (host === "localhost" || host === "ip6-localhost") {
+    return { url: raw.replace(/^(https?:\/\/)[^/:]+/i, "$1127.0.0.1") };
+  }
+  if (isIp || host.includes(".")) return { url: raw };
   return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
 }
 function extractLocationProxies(serverBody) {
@@ -159,6 +181,16 @@ function isHttpsUpgradeForSelf(body, names) {
     return names.includes(host);
   });
 }
+function isAcmeWebrootOnly(body) {
+  const paths = [...body.matchAll(/(?:^|[\s;}])location\s+([^{]+?)\s*\{/g)].map(
+    (m) => m[1].trim()
+  );
+  if (paths.length === 0) {
+    const root = firstDirective(body, "root") ?? "";
+    return /letsencrypt|acme|certbot/i.test(root);
+  }
+  return paths.every((p) => /\.well-known\/acme-challenge/i.test(p));
+}
 function parseServer(body, source, upstreams) {
   const warnings = [];
   const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
@@ -185,10 +217,12 @@ function parseServer(body, source, upstreams) {
     const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
     target = { kind: "proxy", url: primary.url };
     routes = resolved;
-  } else if (root) {
-    target = { kind: "static", root: root.replace(/;$/, "") };
   } else if (isHttpsUpgradeForSelf(body, names)) {
     return { warnings: [] };
+  } else if (root && !isAcmeWebrootOnly(body)) {
+    target = { kind: "static", root: root.replace(/;$/, "") };
+  } else if (root) {
+    return { warnings: [] };
   } else {
     warnings.push(`nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`);
     return { warnings };
@@ -215,7 +249,12 @@ function parseNginxConfig(raw) {
     warnings.push(...blockWarnings);
     if (site) sites.push(site);
   }
-  return { proxy: "nginx", sites, warnings };
+  const { kept } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  return { proxy: "nginx", sites: kept, warnings };
 }
 async function scanNginx(executor) {
   return parseNginxConfig(await loadNginxConfig(executor));
@@ -244,23 +283,61 @@ async function loadCaddyJson(executor) {
   }
   return null;
 }
-function flattenHandlers(handlers, out = []) {
+function flattenHandlers(handlers, scoped = false, out = []) {
   for (const h of handlers ?? []) {
     if (h.handler === "subroute") {
-      for (const r of h.routes ?? []) flattenHandlers(r.handle, out);
+      for (const r of h.routes ?? []) {
+        flattenHandlers(r.handle, scoped || (r.match?.length ?? 0) > 0, out);
+      }
     } else {
-      out.push(h);
+      out.push({ h, scoped });
     }
   }
   return out;
 }
+var UNMIGRATABLE_HANDLERS = {
+  php_fastcgi: "a PHP-FPM site (php_fastcgi)",
+  fastcgi: "a FastCGI backend",
+  static_response: "a static inline response (respond)",
+  templates: "Caddy templates",
+  encode: "",
+  headers: "",
+  authentication: "Caddy authentication",
+  rewrite: "",
+  acme_server: "an embedded ACME server"
+};
 function targetFromRoute(route) {
   const flat = flattenHandlers(route.handle);
-  const dial = flat.find((h) => h.handler === "reverse_proxy")?.upstreams?.find((u) => u.dial)?.dial;
-  if (dial) return { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` };
-  const root = flat.find((h) => h.handler === "vars" && typeof h.root === "string")?.root;
-  if (root && flat.some((h) => h.handler === "file_server")) return { kind: "static", root };
-  return null;
+  const proxies = flat.filter((f) => f.h.handler === "reverse_proxy");
+  const chosen = proxies.find((f) => !f.scoped) ?? proxies[0];
+  const proxy = chosen?.h;
+  if (proxy?.transport?.protocol === "fastcgi") {
+    return { note: "serves a PHP-FPM/FastCGI site (php_fastcgi) \u2014 not an HTTP upstream" };
+  }
+  const pathScopedOnly = Boolean(chosen?.scoped);
+  const hasScopedSibling = proxies.some((f) => f.scoped);
+  const dials = (proxy?.upstreams ?? []).map((u) => u.dial).filter((d) => Boolean(d));
+  if (dials.length > 0) {
+    const dial = dials[0];
+    if (/^unix\//i.test(dial)) {
+      return { note: `proxies to the unix socket "${dial}", which needs a manual upstream` };
+    }
+    return {
+      target: { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` },
+      extraUpstreams: dials.length - 1,
+      pathScopedOnly,
+      hasScopedSibling
+    };
+  }
+  const root = flat.find((f) => f.h.handler === "vars" && typeof f.h.root === "string")?.h.root;
+  if (root && flat.some((f) => f.h.handler === "file_server")) {
+    return { target: { kind: "static", root } };
+  }
+  for (const { h } of flat) {
+    const label = h.handler ? UNMIGRATABLE_HANDLERS[h.handler] : void 0;
+    if (label) return { note: `serves ${label}` };
+  }
+  return {};
 }
 function parseCaddyJson(raw) {
   let cfg;
@@ -272,17 +349,47 @@ function parseCaddyJson(raw) {
   const servers = cfg.apps?.http?.servers;
   if (!servers) return null;
   const sites = [];
+  const warnings = [];
   for (const srv of Object.values(servers)) {
     const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
     for (const route of srv.routes ?? []) {
       const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
       if (hosts.length === 0) continue;
-      const target = targetFromRoute(route);
-      if (!target) continue;
-      sites.push({ serverNames: hosts, ssl, target, source: "caddy (adapt)" });
+      const outcome = targetFromRoute(route);
+      if (outcome.note) {
+        warnings.push(`caddy: ${hosts.join(", ")} ${outcome.note} \u2014 re-add it manually`);
+        continue;
+      }
+      if (!outcome.target) continue;
+      if (outcome.extraUpstreams) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} load-balances across ${outcome.extraUpstreams + 1} upstreams \u2014 only the first is migrated`
+        );
+      }
+      if (outcome.hasScopedSibling || (route.match ?? []).some((m) => m.path?.length)) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} routes some paths to other upstreams \u2014 only the catch-all is migrated; re-add path rules manually`
+        );
+      }
+      if (outcome.pathScopedOnly) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} has no catch-all upstream \u2014 used its path-scoped one; verify the target`
+        );
+      }
+      sites.push({ serverNames: hosts, ssl, target: outcome.target, source: "caddy (adapt)" });
     }
   }
-  return { sites, warnings: [] };
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { sites: kept, warnings };
 }
 async function loadCaddyfile(executor) {
   for (const p of CADDYFILE_PATHS) {
@@ -326,7 +433,7 @@ async function scanCaddy(executor) {
   const json = await loadCaddyJson(executor);
   if (json) {
     const parsed = parseCaddyJson(json);
-    if (parsed && parsed.sites.length > 0) {
+    if (parsed && (parsed.sites.length > 0 || parsed.warnings.length > 0)) {
       return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
     }
   }
@@ -356,19 +463,44 @@ async function scanCaddyText(executor) {
       warnings.push(`caddy: skipped a block with no usable address (${header.slice(0, 40)})`);
       continue;
     }
-    const proxyMatch = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const inlineProxy = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const blockProxy = body.match(/(?:^|\s)reverse_proxy\s*\{([\s\S]*?)\}/);
+    const blockTo = blockProxy?.[1].match(/(?:^|\n)\s*to\s+([^\n]+)/);
     const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
     const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
+    const upstreams = (inlineProxy?.[1] ?? blockTo?.[1] ?? "").trim().split(/\s+/).filter(Boolean);
+    const host = addrs[0].host;
     let target;
-    if (proxyMatch) {
-      const upstream = proxyMatch[1].trim().split(/\s+/)[0];
+    if (upstreams.length > 0) {
+      const upstream = upstreams[0];
+      if (/^unix\//i.test(upstream)) {
+        warnings.push(
+          `caddy: ${host} proxies to the unix socket "${upstream}" \u2014 needs a manual upstream, skipped`
+        );
+        continue;
+      }
+      if (upstreams.length > 1) {
+        warnings.push(
+          `caddy: ${host} load-balances across ${upstreams.length} upstreams \u2014 only the first is migrated`
+        );
+      }
       target = { kind: "proxy", url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}` };
+    } else if (/(?:^|\s)php_fastcgi\s/.test(body)) {
+      warnings.push(
+        `caddy: ${host} serves a PHP-FPM site (php_fastcgi) \u2014 not migratable as a static root; re-add it manually`
+      );
+      continue;
     } else if (rootMatch) {
       target = { kind: "static", root: rootMatch[1] };
     } else {
-      warnings.push(`caddy: ${addrs[0].host} has no reverse_proxy or root \u2014 skipped`);
+      warnings.push(`caddy: ${host} has no reverse_proxy or root \u2014 skipped`);
       continue;
     }
+    if (/(?:^|\s)(handle_path|handle)\s+\//.test(body)) {
+      warnings.push(
+        `caddy: ${host} routes by path (handle/handle_path) \u2014 only one upstream is migrated; re-add path rules manually`
+      );
+    }
     const site = {
       serverNames: addrs.map((a) => a.host),
       ssl: addrs.some((a) => a.ssl),
@@ -380,7 +512,17 @@ async function scanCaddyText(executor) {
     }
     sites.push(site);
   }
-  return { proxy: "caddy", sites, warnings };
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { proxy: "caddy", sites: kept, warnings };
 }
 
 // ../../packages/adapters/src/system/proxy/import/apache.ts
@@ -418,24 +560,51 @@ function directiveAll(body, name) {
     (m) => m[1].trim()
   );
 }
+function isHttpsRedirectOnly(body) {
+  const hasProxy = /(?:^|\n)\s*ProxyPass\s+\S+\s+(?!!)\S/i.test(body);
+  if (hasProxy) return false;
+  const redirects = [
+    ...body.matchAll(/(?:^|\n)\s*Redirect(?:Permanent|Match)?\s+(?:\d{3}\s+|permanent\s+|temp\s+)?\S*\s*(\S+)/gi),
+    ...body.matchAll(/(?:^|\n)\s*RewriteRule\s+\S+\s+(\S+)\s*\[[^\]]*R=?3\d\d[^\]]*\]/gi)
+  ].map((m) => m[1]);
+  return redirects.length > 0 && redirects.some((t) => /^https:\/\//i.test(t));
+}
+function hostOnly(name) {
+  return name.trim().replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+}
 function parseVhost(body, portHint) {
   const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
   const aliases = directiveAll(body, "ServerAlias").flatMap((line) => line.split(/\s+/));
-  const names = [serverName, ...aliases].filter((n) => Boolean(n));
+  const names = [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
   if (names.length === 0) {
     return { warning: "apache: skipped a VirtualHost with no ServerName" };
   }
+  if (isHttpsRedirectOnly(body)) return null;
   const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
   const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
+  const fcgiMatch = /(?:^|\n)\s*ProxyPassMatch\s+[^\n]*(fcgi:|php-fpm|php\d*-fpm|\.sock)/i.test(body);
   const certPath = directive(body, "SSLCertificateFile");
   const keyPath = directive(body, "SSLCertificateKeyFile");
   const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
   let target;
   if (routes.length > 0) {
     const primary = routes.find((r) => r.path === "/") ?? routes[0];
+    if (/^balancer:\/\//i.test(primary.url)) {
+      return {
+        warning: `apache: ${names[0]} proxies to an mod_proxy_balancer cluster (${primary.url}) \u2014 re-add its members manually`
+      };
+    }
     target = { kind: "proxy", url: primary.url };
+  } else if (fcgiMatch) {
+    return {
+      warning: `apache: ${names[0]} is a PHP-FPM site (ProxyPassMatch \u2192 FastCGI) \u2014 not migratable as a static root; re-add it manually`
+    };
   } else if (docRoot) {
     target = { kind: "static", root: docRoot };
+  } else if (/(?:^|\n)\s*ProxyPassMatch\s/i.test(body)) {
+    return {
+      warning: `apache: ${names[0]} uses ProxyPassMatch (regex proxying) \u2014 re-add it manually`
+    };
   } else {
     return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
   }
@@ -444,6 +613,11 @@ function parseVhost(body, portHint) {
   if (certPath && keyPath) site.tls = { certPath, keyPath };
   return site;
 }
+function redirectVhostNames(body) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap((l) => l.split(/\s+/));
+  return [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
+}
 function vhostBlocks(text) {
   const out = [];
   const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
@@ -463,15 +637,44 @@ async function scanApache(executor) {
   const text = stripComments(raw);
   const blocks = vhostBlocks(text);
   if (blocks.length === 0) warnings.push("apache: no <VirtualHost> blocks found");
+  const redirectOnlyHosts = [];
   for (const { args, body } of blocks) {
     const parsed = parseVhost(body, args);
+    if (parsed === null) {
+      redirectOnlyHosts.push(redirectVhostNames(body));
+      continue;
+    }
     if ("warning" in parsed) warnings.push(parsed.warning);
     else sites.push(parsed);
   }
-  return { proxy: "apache", sites, warnings };
+  const served = new Set(sites.flatMap((s) => s.serverNames));
+  for (const names of redirectOnlyHosts) {
+    const orphaned = names.filter((n) => !served.has(n));
+    if (orphaned.length > 0) {
+      warnings.push(
+        `apache: ${orphaned.join(", ")} only redirected to HTTPS and has no TLS VirtualHost here \u2014 nothing to serve it after migration`
+      );
+    }
+  }
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `apache: ${d.serverNames.join(", ")} had a second VirtualHost (${d.ssl ? "TLS" : "plain HTTP"}, ${d.target.kind}) \u2014 kept the TLS/proxy one`
+    );
+  }
+  return { proxy: "apache", sites: kept, warnings };
 }
 
 // ../../packages/adapters/src/system/proxy/import/traefik.ts
+function lowerKeys(labels) {
+  const out = {};
+  for (const [k, v] of Object.entries(labels)) out[k.toLowerCase()] = v;
+  return out;
+}
 function extractHosts(rule) {
   const hosts = [];
   for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
@@ -480,7 +683,7 @@ function extractHosts(rule) {
       if (h) hosts.push(h);
     }
   }
-  return hosts;
+  return [...new Set(hosts)];
 }
 function extraMatchers(rule) {
   const found = /* @__PURE__ */ new Set();
@@ -491,23 +694,59 @@ function extraMatchers(rule) {
   }
   return [...found];
 }
+function collectDefinitions(containers) {
+  const services = /* @__PURE__ */ new Map();
+  const redirectMiddlewares = /* @__PURE__ */ new Set();
+  const streamRouters = [];
+  let fileProvider = false;
+  let exposedByDefault = true;
+  for (const c of containers) {
+    const labels = lowerKeys(c.labels);
+    for (const [k, v] of Object.entries(labels)) {
+      let m = k.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.(port|scheme)$/);
+      if (m) {
+        const def = services.get(m[1]) ?? {};
+        if (m[2] === "port") def.port = v;
+        else def.scheme = v;
+        services.set(m[1], def);
+        continue;
+      }
+      m = k.match(/^traefik\.http\.middlewares\.([^.]+)\.redirectscheme\./);
+      if (m) {
+        redirectMiddlewares.add(m[1]);
+        continue;
+      }
+      m = k.match(/^traefik\.(tcp|udp)\.routers\.([^.]+)\.rule$/);
+      if (m) streamRouters.push(`${m[1]} router "${m[2]}"`);
+    }
+    const cmd = c.cmd ?? "";
+    if (/--?providers\.file/i.test(cmd)) fileProvider = true;
+    if (/--?providers\.docker\.exposedbydefault[= ]?false/i.test(cmd)) exposedByDefault = false;
+  }
+  return { services, redirectMiddlewares, streamRouters, fileProvider, exposedByDefault };
+}
+function resolveIp(c, labels) {
+  const wanted = labels["traefik.docker.network"];
+  if (wanted && c.networks?.[wanted]) return c.networks[wanted];
+  if (c.ip) return c.ip;
+  const first = Object.values(c.networks ?? {}).find(Boolean);
+  return first || void 0;
+}
 function parseTraefikLabels(containers) {
-  const sites = [];
   const warnings = [];
+  const defs = collectDefinitions(containers);
+  const candidates = [];
   for (const c of containers) {
-    if (c.labels["traefik.enable"] === "false") continue;
+    const labels = lowerKeys(c.labels);
+    if (labels["traefik.enable"] === "false") continue;
+    if (!defs.exposedByDefault && labels["traefik.enable"] !== "true") continue;
     const routers = /* @__PURE__ */ new Map();
-    const servicePorts = /* @__PURE__ */ new Map();
-    for (const [key, val] of Object.entries(c.labels)) {
+    for (const [key, val] of Object.entries(labels)) {
       const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
-      if (r) {
-        const bag = routers.get(r[1]) ?? {};
-        bag[r[2]] = val;
-        routers.set(r[1], bag);
-        continue;
-      }
-      const s = key.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.port$/);
-      if (s) servicePorts.set(s[1], val);
+      if (!r) continue;
+      const bag = routers.get(r[1]) ?? {};
+      bag[r[2]] = val;
+      routers.set(r[1], bag);
     }
     for (const [rname, props] of routers) {
       const rule = props.rule;
@@ -519,47 +758,92 @@ function parseTraefikLabels(containers) {
         );
         continue;
       }
-      if (!c.ip) {
+      const ip = resolveIp(c, labels);
+      if (!ip) {
         warnings.push(
           `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
         );
         continue;
       }
-      const svc = props.service;
-      const rawPort = (svc && servicePorts.get(svc)) ?? (servicePorts.size === 1 ? [...servicePorts.values()][0] : void 0) ?? "80";
+      const svc = props.service?.replace(/@.*$/, "");
+      const def = (svc ? defs.services.get(svc) : void 0) ?? (defs.services.size === 1 ? [...defs.services.values()][0] : void 0);
+      const onlyExposed = c.exposedPorts?.length === 1 ? c.exposedPorts[0].split("/")[0] : void 0;
+      const rawPort = def?.port ?? onlyExposed;
       const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
-      const url = `http://${c.ip}:${port}`;
-      const extras = extraMatchers(rule);
-      if (extras.length > 0) {
-        warnings.push(
-          `traefik: ${hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
-        );
-      }
-      if (props.middlewares) {
-        warnings.push(`traefik: ${hosts.join(", ")} uses middleware(s) "${props.middlewares}" \u2014 not migrated`);
-      }
-      const ssl = Object.keys(props).some((p) => p === "tls" || p.startsWith("tls."));
-      sites.push({
-        serverNames: hosts,
-        ssl,
-        target: { kind: "proxy", url },
-        source: `traefik container ${c.name}`
+      const scheme = def?.scheme?.toLowerCase() === "https" ? "https" : "http";
+      const middlewares = (props.middlewares ?? "").split(",").map((m) => m.trim().replace(/@.*$/, "")).filter(Boolean);
+      candidates.push({
+        hosts,
+        ssl: Object.keys(props).some((p) => p === "tls" || p.startsWith("tls.")),
+        url: `${scheme}://${ip}:${port}`,
+        container: c.name,
+        router: rname,
+        rule,
+        middlewares,
+        redirectOnly: middlewares.length > 0 && middlewares.every((m) => defs.redirectMiddlewares.has(m)),
+        portGuessed: rawPort === void 0
       });
     }
   }
-  return { proxy: "traefik", sites, warnings };
+  const { kept: sites, dropped } = collapseByHost(
+    candidates,
+    (c) => c.hosts,
+    (c) => c.redirectOnly ? 0 : c.ssl ? 2 : 1
+  );
+  for (const cand of sites) {
+    const extras = extraMatchers(cand.rule);
+    if (extras.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
+      );
+    }
+    const carried = cand.middlewares.filter((m) => !defs.redirectMiddlewares.has(m));
+    if (carried.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} uses middleware(s) "${carried.join(", ")}" \u2014 not migrated`
+      );
+    }
+    if (cand.portGuessed) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} \u2014 no service port label and no single exposed port on ${cand.container}; assumed :80, check the upstream`
+      );
+    }
+  }
+  for (const d of dropped) {
+    warnings.push(
+      `traefik: ${d.hosts.join(", ")} router "${d.router}" is an http\u2192https redirect \u2014 Openship's edge does that itself (nothing to migrate)`
+    );
+  }
+  for (const s of defs.streamRouters) {
+    warnings.push(`traefik: ${s} can't migrate \u2014 Openship's edge routes HTTP(S), not raw TCP/UDP`);
+  }
+  if (defs.fileProvider) {
+    warnings.push(
+      "traefik: a file provider is configured \u2014 routes defined in its YAML/TOML files are NOT read here, only container labels. Re-add those domains manually."
+    );
+  }
+  return {
+    proxy: "traefik",
+    sites: sites.map((cand) => ({
+      serverNames: cand.hosts,
+      ssl: cand.ssl,
+      target: { kind: "proxy", url: cand.url },
+      source: `traefik container ${cand.container}`
+    })),
+    warnings
+  };
 }
 async function scanTraefik(executor) {
   const out = await tryExec(
     executor,
-    "docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null"
+    `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
   );
   if (!out) {
     return { proxy: "traefik", sites: [], warnings: ["traefik: couldn't read container labels via docker inspect"] };
   }
   const containers = [];
   for (const line of out.split("\n")) {
-    const [rawName, rawLabels, rawIps] = line.split("	");
+    const [rawName, rawLabels, rawNets, rawPorts, rawCmd] = line.split("	");
     if (!rawName || !rawLabels) continue;
     let labels;
     try {
@@ -567,9 +851,30 @@ async function scanTraefik(executor) {
     } catch {
       continue;
     }
-    if (!Object.keys(labels).some((k) => k.startsWith("traefik."))) continue;
-    const ip = (rawIps ?? "").trim().split(/\s+/)[0] || void 0;
-    containers.push({ name: rawName.replace(/^\//, ""), labels, ip });
+    const networks = {};
+    let bareIp;
+    for (const pair of (rawNets ?? "").trim().split(/\s+/)) {
+      if (!pair) continue;
+      const eq = pair.indexOf("=");
+      if (eq > 0) {
+        const ip = pair.slice(eq + 1);
+        if (ip) networks[pair.slice(0, eq)] = ip;
+      } else if (!bareIp) {
+        bareIp = pair;
+      }
+    }
+    const exposedPorts = (rawPorts ?? "").trim().split(/\s+/).filter(Boolean);
+    const hasTraefikLabels = Object.keys(labels).some((k) => k.toLowerCase().startsWith("traefik."));
+    const looksLikeTraefik = /traefik/i.test(rawCmd ?? "") || /--?providers\./i.test(rawCmd ?? "");
+    if (!hasTraefikLabels && !looksLikeTraefik) continue;
+    containers.push({
+      name: rawName.replace(/^\//, ""),
+      labels,
+      ip: Object.values(networks)[0] ?? bareIp,
+      networks,
+      exposedPorts,
+      cmd: rawCmd ?? void 0
+    });
   }
   return parseTraefikLabels(containers);
 }
@@ -1842,7 +2147,7 @@ async function runningImage(executor, container) {
   return out.trim() || null;
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  const { NginxProvider: Provider } = await import("./nginx-QE4DOM5J.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -1852,21 +2157,38 @@ async function containerEdgeProvider(executor, container, opts) {
     executor: edgeContainerExecutor(executor, container),
     // MUST be pinned: re-detection answers from inside the container and would
     // repoint sitesDir at a host dir the edge never reads.
-    pinPaths: true
+    pinPaths: true,
+    // Reload runs INSIDE the container, where the master is pid 1 — so a failed
+    // reload must never fall back to killing it (#292).
+    containerEdge: true
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
-  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-5I4M5QT7.js");
+  const { NginxProvider: Provider } = await import("./nginx-QE4DOM5J.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
     executor: new DockerEdgeExecutor({ containerName: container }),
     // nginx.conf + the Lua are BAKED into the image — nothing to detect, install
     // or patch, and detection would answer from inside the container anyway.
-    pinPaths: true
+    pinPaths: true,
+    // `docker exec`s into the edge, so the master is pid 1 there too (#292).
+    containerEdge: true
   });
 }
+async function startEdgeContainer(executor, container, image, onLog) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {
+  });
+  await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+  });
+  const run = await executor.streamExec(
+    buildEdgeRunCommand(container, image),
+    onLog
+  );
+  invalidateEdgeContainer(executor);
+  return run.code === 0;
+}
 function buildEdgeRunCommand(container, image) {
   const mounts = EDGE_CONTAINER_MOUNTS.map(
     // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
@@ -1890,14 +2212,7 @@ async function swapEdgeImage(executor, container, from, to, opts) {
     return { swapped: false, edgeDown: false };
   }
   const start = async (image) => {
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) return false;
+    if (!await startEdgeContainer(executor, container, image, onLog)) return false;
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
@@ -1920,29 +2235,6 @@ async function listDir(executor, dir) {
     out.split("\n").map((l) => l.trim()).filter(Boolean)
   );
 }
-async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
-  const script = [
-    `for f in ${sq(sitesDir)}/*.conf; do`,
-    `  [ -f "$f" ] || continue;`,
-    // A real server_name is anything that isn't the `_` wildcard.
-    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
-    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
-    `  fi;`,
-    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
-    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
-    `  fi;`,
-    `done`
-  ].join(" ");
-  const out = await executor.exec(script).catch(() => "");
-  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
-    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
-    if (action === "dropped-catchall") {
-      onLog(log4(`Dropped the bare edge's catch-all ${file} \u2014 the edge image provides it.`, "warn"));
-    } else if (action === "unset-default") {
-      onLog(log4(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
-    }
-  }
-}
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
@@ -1989,7 +2281,6 @@ async function ensureContainerEdge(executor, opts) {
       beforeCarry = await listDir(executor, sitesTarget);
       await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
       });
-      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
   }
   const restoreBare = async () => {
@@ -2015,15 +2306,10 @@ async function ensureContainerEdge(executor, opts) {
       await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
       });
     }
-    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
-    });
     onLog(log4("Starting the edge container..."));
-    const run = await executor.streamExec(
-      buildEdgeRunCommand(container, image),
-      onLog
-    );
-    invalidateEdgeContainer(executor);
-    if (run.code !== 0) throw new Error("the edge container failed to start");
+    if (!await startEdgeContainer(executor, container, image, onLog)) {
+      throw new Error("the edge container failed to start");
+    }
     await executor.exec(containerCommand(container, "openresty -t"));
     const listening = await waitForPortListening(executor, 80, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4