# ─────────────────────────────────────────────────────────────────────────────
# Traefik STATIC configuration — 43-meditsina
# Host path: /mnt/containers/traefik/container-data/traefik.yml
# Changes here need a container restart (the dynamic/ files hot-reload instead).
# ─────────────────────────────────────────────────────────────────────────────

global:
  checkNewVersion: false
  sendAnonymousUsage: false

entryPoints:
  web:
    address: ":80"
    # NOTE: NO entrypoint-level http->https redirection here, deliberately.
    # An entrypoint redirect is installed as an internal router at near-max priority,
    # which would swallow the /.well-known/acme-challenge/ path before the
    # `exchange-acme` router could forward it to Exchange. The redirect is instead a
    # normal low-priority catch-all router in dynamic/services.yml, so the ACME
    # router can outrank it deterministically.
  websecure:
    address: ":443"
    # NO default TLS cert/resolver on the entrypoint — the Exchange TCP pass-through
    # router must own the raw TLS for its SNIs. L7 hosts set certResolver per-router.

providers:
  file:
    directory: /etc/traefik/dynamic
    watch: true

certificatesResolvers:
  le:
    acme:
      email: admin@shcnw.ru                # ← set a MONITORED mailbox before deploying
      storage: /etc/traefik/acme/acme.json
      # TLS-ALPN-01, not HTTP-01, and this is load-bearing:
      # httpChallenge would install Traefik's own handler on :80 for
      # /.well-known/acme-challenge/, which competes with forwarding that same path to
      # Exchange for ITS renewal. TLS-ALPN runs entirely on :443 and leaves :80 free.
      # The Exchange SNIs are pass-through and never request a Traefik cert, so the
      # ALPN challenge only ever runs for the L7 names below — no overlap.
      tlsChallenge: {}
      # ── FIRST CUTOVER: uncomment to use Let's Encrypt STAGING and avoid burning
      #    rate limits while shaking out DNS/ports. Then re-comment, truncate
      #    acme.json, and restart so production certs issue. ──
      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory

api:
  dashboard: true            # reachable only via the LAN-only + basic-auth router

log:
  level: INFO

accessLog:
  filePath: /var/log/traefik/access.log
  format: common
  bufferingSize: 100