installer: additive yq merge silently overrides a customized coolify_dashboard entrypoint and orphans the old port

[techwithanirudh]

Summary

Step 3 patches the Traefik service by appending with | unique:

.services.traefik.ports = ((.services.traefik.ports // []) + ["8000:8000"] | unique)
| .services.traefik.command = ((.services.traefik.command // []) + [
    ...
    "--entrypoints.coolify_dashboard.address=:8000"
  ] | unique)

Append-only. If the host already defines coolify_dashboard on a different port, the installer cannot replace it — it just adds a second one. The result is a silently overridden entrypoint plus a dead published port.

What actually happens

Running the exact step-3 transform against a compose file that already had '3000:3000' and --entrypoints.coolify_dashboard.address=:3000:

ports:
  - '80:80'
  - '443:443'
  - '443:443/udp'
  - '8080:8080'
  - '3000:3000'     # still here
  - 8000:8000       # added
command:
  - --entrypoints.coolify_dashboard.address=:3000   # still here
  - --entrypoints.coolify_dashboard.address=:8000   # added

Traefik does not error on the duplicate. Verified against traefik:v3.6 with both flags — it starts normally and last-flag-wins:

$ curl -s localhost:8080/api/entrypoints
[{"address":":8000","name":"coolify_dashboard"}, ...]

$ netstat -ltn   # inside the container
tcp  0  0 :::8000  :::*  LISTEN     # only 8000

So the outcome is quiet rather than loud, which arguably makes it worse:

• the user's configured :3000 is discarded with no error and no warning
• 3000:3000 remains published on the host, now routing to nothing
• nothing in the installer output indicates the entrypoint moved

Scope

This only affects hosts whose Traefik config was customized by hand — the entrypoint port has been :8000 in every published version of the script, so there is no version-drift path into this state. It surfaced on my host because I had moved the dashboard entrypoint to 3000 manually (Coolify itself sits on stock 8000).

Still worth handling: the installer is documented as re-runnable, and "re-run it" is the natural response to any problem, so it should either converge on a correct config or refuse.

Suggested fix

Set the entrypoint declaratively rather than appending — drop any existing --entrypoints.coolify_dashboard.address= before adding the canonical one:

.services.traefik.command = (
  (.services.traefik.command // [])
  | map(select(test("--entrypoints\\.coolify_dashboard\\.address=") | not))
  + [ ... "--entrypoints.coolify_dashboard.address=:8000" ]
  | unique
)

and likewise reconcile the stale N:N port publish. If removing a user's setting automatically is too aggressive, detecting the conflicting entrypoint and stopping with an explanation would be a fine alternative — anything other than silently winning.

Related: #62, #63. Companion issues: #66 (dynamic config clobbering), #67 (missing pre-flight port check).