initial traefik layout

traefik/dynamic/passthrough.yml

@@ -0,0 +1,51 @@
+# SNI TLS pass-through (Layer 4) to the Windows backends.
+#
+# Traefik does NOT terminate TLS for these — it reads the SNI from the TLS
+# ClientHello and forwards the raw connection to the backend, which terminates
+# TLS itself and performs its own NATIVE auth (Kerberos / NTLM / Negotiate).
+# This is the whole point: it preserves Windows-Integrated auth that an
+# HTTP-terminating proxy (NPM/openresty) breaks.
+#
+# Requirements:
+#  - Clients MUST send SNI (all modern Outlook / ActiveSync / Work Folders do).
+#  - Each backend must present a cert valid for its own hostname(s):
+#      serverfile  -> files.osk.team + workfolders.osk.team (LE, 9b279156…)
+#      servermail  -> mail.osk.team + autodiscover.osk.team (Exchange cert)
+#      serverwsus  -> kdcproxy.osk.team (self-signed, 02B9ADB3…)
+
+tcp:
+  routers:
+    workfolders:
+      entryPoints: ["websecure"]
+      rule: "HostSNI(`workfolders.osk.team`)"
+      tls:
+        passthrough: true
+      service: serverfile-wf
+
+    exchange:
+      entryPoints: ["websecure"]
+      rule: "HostSNI(`mail.osk.team`, `autodiscover.osk.team`)"
+      tls:
+        passthrough: true
+      service: servermail-ex
+
+    kdcproxy:
+      entryPoints: ["websecure"]
+      rule: "HostSNI(`kdcproxy.osk.team`)"
+      tls:
+        passthrough: true
+      service: serverwsus-kdc
+
+  services:
+    serverfile-wf:
+      loadBalancer:
+        servers:
+          - address: "192.168.0.11:443"   # serverfile — Work Folders
+    servermail-ex:
+      loadBalancer:
+        servers:
+          - address: "192.168.0.6:443"    # servermail — Exchange 2019
+    serverwsus-kdc:
+      loadBalancer:
+        servers:
+          - address: "192.168.0.7:443"    # serverwsus — KDC proxy

traefik/dynamic/web.yml

@@ -0,0 +1,52 @@
+# HTTP routers for the web dashboards — Traefik TERMINATES TLS here and
+# auto-issues Let's Encrypt certs (resolver "le"). These hosts have no
+# Windows-Integrated auth, so termination is fine.
+#
+# ACME http-01 requires each Host below to be publicly resolvable and reachable
+# on :80 through the edge. For internal-only dashboards, use a dnsChallenge or a
+# default cert instead (see traefik.yml).
+
+http:
+  routers:
+    flame:
+      entryPoints: ["websecure"]
+      rule: "Host(`start.osk.team`)"
+      service: flame
+      tls:
+        certResolver: le
+
+    portainer:
+      entryPoints: ["websecure"]
+      rule: "Host(`portainer.osk.team`)"
+      service: portainer
+      tls:
+        certResolver: le
+
+    traefik-dashboard:
+      entryPoints: ["websecure"]
+      rule: "Host(`traefik.osk.team`)"
+      service: api@internal
+      middlewares: ["dash-auth"]
+      tls:
+        certResolver: le
+
+  services:
+    flame:
+      loadBalancer:
+        servers:
+          - url: "http://flame:5005"
+    portainer:
+      # Portainer must share a network with Traefik. Either add the portainer
+      # container to reverseproxy-nw, or point this at the host IP instead:
+      #   - url: "https://192.168.0.8:9443"  (+ serversTransport insecureSkipVerify)
+      loadBalancer:
+        servers:
+          - url: "https://192.168.0.8:9443"
+
+  middlewares:
+    dash-auth:
+      basicAuth:
+        # Generate: htpasswd -nbB admin 'yourpassword'  (escape $ as $$ only in
+        # docker-compose labels — in this YAML file use the raw single-$ hash).
+        users:
+          - "admin:$2y$05$HjhBPjFYOxYTWS37DScedenZRiRZ.qbxMsf10XQVujzCljE9VbQfG"