proxy.ssl = true (the default) requests a real ACME certificate for services.hortusfox-web.domain. Left at its own default of "localhost", that request can never succeed -- Let's Encrypt won't issue for it -- but previously this only surfaced as an ACME failure at activation time. Catch it at eval time instead with a clear assertion message. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>