Some checks failed
CI / lint (push) Successful in 30s
CI / notebooks-smoke (push) Successful in 1m41s
CI / test (push) Failing after 2m18s
CI / lint (pull_request) Successful in 31s
CI / notebooks-smoke (pull_request) Successful in 1m28s
CI / test (pull_request) Failing after 2m30s
Infra CI / notebooks (pull_request) Successful in 1m0s
Infra CI / docs (pull_request) Successful in 13s
Infra CI / zotero (pull_request) Successful in 22s
Infra CI / api (pull_request) Successful in 19s
Infra CI / bcda (pull_request) Successful in 16s
Infra CI / mc (pull_request) Failing after 49s
Infra CI / llm (pull_request) Successful in 15s
The tunnel runs on a remote ingress list pushed by bootstrap_sso (it overrides the wildcard in infra/cloudflared/config.yml), and the public CNAMEs are created from the same SUBDOMAINS list, so a service that only exists in stack.toml and Traefik answers 530 at the Cloudflare edge and NXDOMAIN on public DNS — which is what bcda.fhirworx.io did. Adding a service now means appending it here and running `CF_API_TOKEN=… uv run python dev/scripts/bootstrap_sso.py --dns-only`, which does the two Cloudflare writes without the Gitea admin flow. refs #1139