syntax

traefik/README.md

@@ -21,8 +21,13 @@ Replaces **nginx-proxy-manager** on serverweb. One `:443` entrypoint that does
 | `dynamic/passthrough.yml` | the TCP SNI-passthrough routers → Windows hosts |
 | `dynamic/web.yml` | HTTP routers (dashboards) + dashboard basic-auth |
 
-Routing config lives in git and redeploys on push (file provider, `watch: true`).
-`acme.json` is **not** in git — it holds private keys and persists on the host.
+Config files (`traefik.yml`, `dynamic/`) are the source of truth in git, but must be
+**placed on the host** at `/mnt/containers/traefik/container-data/` and mounted by
+**absolute path**. Portainer GitOps runs compose with paths relative to its own
+container (`/data/compose/<id>/…`), which the Docker daemon can't resolve — so relative
+`./` bind mounts silently become empty dirs (`is a directory` crash loop). Keep the host
+copies in sync with this repo; Traefik's `watch: true` still hot-reloads `dynamic/` when
+the host files change. `acme.json` is **not** in git (private keys) and persists on the host.
 
 ## One-time host prep (serverweb)
 
@@ -30,6 +35,14 @@ Routing config lives in git and redeploys on push (file provider, `watch: true`)
 mkdir -p /mnt/containers/traefik/container-data/acme
 touch    /mnt/containers/traefik/container-data/acme/acme.json
 chmod 600 /mnt/containers/traefik/container-data/acme/acme.json
+mkdir -p /mnt/containers/traefik/container-data/dynamic
+```
+
+Then copy the config from this repo onto the host (re-copy whenever they change):
+
+```bash
+scp traefik.yml   root@serverweb:/mnt/containers/traefik/container-data/traefik.yml
+scp dynamic/*.yml root@serverweb:/mnt/containers/traefik/container-data/dynamic/
 ```
 
 ## Before deploying — edit