pipistrelloandClaude Opus 4.8
d222121e6d
Repo traefik files had drifted behind the live config on serverweb. Pull the authoritative versions: file-only provider (drop docker provider), Portainer self-signed serversTransport, and correct '||' HostSNI syntax for exchange. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
# Traefik v3 static configuration (ОСК reverse proxy / SNI router)
|
|
# Mounted read-only at /etc/traefik/traefik.yml
|
|
|
|
global:
|
|
checkNewVersion: false
|
|
sendAnonymousUsage: false
|
|
|
|
log:
|
|
level: INFO
|
|
accessLog: {}
|
|
|
|
api:
|
|
dashboard: true # exposed via dynamic/web.yml router (traefik.osk.team) with basic-auth
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
# NOTE: TLS-passthrough TCP routers and TLS-terminating HTTP routers coexist
|
|
# on :443 — Traefik matches specific HostSNI(...) TCP routers first, and
|
|
# everything else falls through to the HTTP routers.
|
|
|
|
providers:
|
|
# File provider = ALL routing (SNI passthrough + dashboards). No docker
|
|
# provider — every service is defined in dynamic/*.yml, so Traefik needs no
|
|
# access to the docker socket (avoids the SELinux socket-permission denial).
|
|
file:
|
|
directory: /etc/traefik/dynamic
|
|
watch: true
|
|
|
|
# Let's Encrypt — only for hosts Traefik TERMINATES (dashboards).
|
|
# Passthrough hosts (workfolders/mail/kdcproxy) keep their own backend certs.
|
|
certificatesResolvers:
|
|
le:
|
|
acme:
|
|
email: gamroot@osk.team # <-- CHANGE to a real address
|
|
storage: /acme/acme.json
|
|
httpChallenge:
|
|
entryPoint: web
|
|
# For internal-only dashboards not reachable on :80 from the internet,
|
|
# switch to a dnsChallenge or a default self-signed cert instead.
|