- Shipped
- July 7, 2026 at 12:36 AM UTC
- Author
- Kamo
- Commit
- 5535b6c
The log-scan discovery mechanism can never bootstrap the `media` alias: it is only ever contacted by the browser over a WebSocket/XHR subresource (SockJS /ws/info from the softphone/chat/sms/realtime hooks). With no cert, the browser aborts at the TLS handshake (ERR_CERT_AUTHORITY_INVALID) and never sends an HTTP request, so media.<org> never appears in Traefik's access logs and is never discovered — a deadlock. Every other alias self-bootstraps because it has a full-page navigation or server-side fetch that produces a log line; media has none. Fix: for every observed+allowed org host <alias>.<parent>, also queue media.<parent> so it self-heals. Gated on the source host being a registered org domain so scanner junk never spawns media.<junk> lookups. Symptom: media.optionone.com served Traefik's default self-signed cert; all other optionone.com aliases had valid certs.