Troubleshooting

Hostnames do not resolve

doctor warns: does not resolve; a router or local DNS server may be stripping private-IP answers. Some routers and resolvers drop DNS answers that point to private addresses. Compare your resolver with a public one:

$ dig +short app-u3.192-168-1-20.traefik.me
$ dig +short app-u3.192-168-1-20.traefik.me @1.1.1.1

Empty from the first and an address from the second means your resolver strips it. Allow private answers for that domain (often called DNS rebinding protection), point the device at another resolver, or use a domain you own.

Port 80 or 8001 is already in use

doctor fails with entrypoint web needs port 80, which is taken by another process when the proxy is not running yet. Find the owner and stop it:

$ ss -ltnp 'sport = :80'
$ multiversectl doctor

Or move the entrypoint in the manifest (spec.proxy.entrypoints); urls then prints the port.

A secret file is missing

new warns, and doctor 3 fails with secret <app>: missing <path>. Secrets listed under an app's secrets: are copied from the shared clone into each universe. Put the file in the clone, then run new again (existing checkouts are kept):

$ cp .env ~/acme/api/.env
$ multiversectl new 3
$ multiversectl doctor 3

A dev server answers 403

Many dev servers reject Host headers they do not know, and a universe answers on app-u3.<domain>. Allow the hostname, using the variable the manifest passes in, through an inline overlay (the environment variable is whatever your server reads):

apps:
  - name: web
    repo: web
    overlay:
      services:
        app-dev:
          environment:
            ALLOWED_HOSTS: "${APP_HOST}"

Also check that the hostname is the one multiversectl urls 3 prints, and that the service has the label or the single port that routes it.