Sync traefik config from docker host (host is source of truth)

Repo traefik files had drifted behind the live config on serverweb. Pull the
authoritative versions: file-only provider (drop docker provider), Portainer
self-signed serversTransport, and correct '||' HostSNI syntax for exchange.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

traefik/dynamic/passthrough.yml

@@ -24,7 +24,7 @@ tcp:
 
     exchange:
       entryPoints: ["websecure"]
-      rule: "HostSNI(`mail.osk.team`, `autodiscover.osk.team`)"
+      rule: "HostSNI(`mail.osk.team`) || HostSNI(`autodiscover.osk.team`)"
       tls:
         passthrough: true
       service: servermail-ex

traefik/dynamic/web.yml

@@ -7,6 +7,10 @@
 # default cert instead (see traefik.yml).
 
 http:
+  serversTransports:
+    insecure:                 # skip cert verification to self-signed backends (Portainer 9443)
+      insecureSkipVerify: true
+
   routers:
     flame:
       entryPoints: ["websecure"]

traefik/traefik.yml

@@ -27,11 +27,9 @@ entryPoints:
   # everything else falls through to the HTTP routers.
 
 providers:
-  # Docker labels (for local containers that opt in with traefik.enable=true)
-  docker:
-    exposedByDefault: false
-    network: reverseproxy-nw
-  # File provider = all the static routing (SNI passthrough + dashboards)
+  # File provider = ALL routing (SNI passthrough + dashboards). No docker
+  # provider — every service is defined in dynamic/*.yml, so Traefik needs no
+  # access to the docker socket (avoids the SELinux socket-permission denial).
   file:
     directory: /etc/traefik/dynamic
     watch: true