From d222121e6d3fc4fb0885e61df23c674b9c60863c Mon Sep 17 00:00:00 2001 From: pipistrello Date: Thu, 25 Jun 2026 14:59:32 +0300 Subject: [PATCH] Sync traefik config from docker host (host is source of truth) Repo traefik files had drifted behind the live config on serverweb. Pull the authoritative versions: file-only provider (drop docker provider), Portainer self-signed serversTransport, and correct '||' HostSNI syntax for exchange. Co-Authored-By: Claude Opus 4.8 --- traefik/dynamic/passthrough.yml | 2 +- traefik/dynamic/web.yml | 4 ++++ traefik/traefik.yml | 8 +++----- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/traefik/dynamic/passthrough.yml b/traefik/dynamic/passthrough.yml index 8425ccf..a36bc4f 100644 --- a/traefik/dynamic/passthrough.yml +++ b/traefik/dynamic/passthrough.yml @@ -24,7 +24,7 @@ tcp: exchange: entryPoints: ["websecure"] - rule: "HostSNI(`mail.osk.team`, `autodiscover.osk.team`)" + rule: "HostSNI(`mail.osk.team`) || HostSNI(`autodiscover.osk.team`)" tls: passthrough: true service: servermail-ex diff --git a/traefik/dynamic/web.yml b/traefik/dynamic/web.yml index 4aee2c5..15471fe 100644 --- a/traefik/dynamic/web.yml +++ b/traefik/dynamic/web.yml @@ -7,6 +7,10 @@ # default cert instead (see traefik.yml). http: + serversTransports: + insecure: # skip cert verification to self-signed backends (Portainer 9443) + insecureSkipVerify: true + routers: flame: entryPoints: ["websecure"] diff --git a/traefik/traefik.yml b/traefik/traefik.yml index a042951..0eba504 100644 --- a/traefik/traefik.yml +++ b/traefik/traefik.yml @@ -27,11 +27,9 @@ entryPoints: # everything else falls through to the HTTP routers. providers: - # Docker labels (for local containers that opt in with traefik.enable=true) - docker: - exposedByDefault: false - network: reverseproxy-nw - # File provider = all the static routing (SNI passthrough + dashboards) + # File provider = ALL routing (SNI passthrough + dashboards). No docker + # provider — every service is defined in dynamic/*.yml, so Traefik needs no + # access to the docker socket (avoids the SELinux socket-permission denial). file: directory: /etc/traefik/dynamic watch: true