# Traefik static configuration — DEFAULT / PRODUCTION.
#
# Selected by TRAEFIK_STATIC_CONFIG in .env (defaults to this file).
# The dev host uses traefik.dev.yml, which differs ONLY in the ACME challenge
# type, because public port 80 forwards to prod so HTTP-01 cannot work there.
#
# NOTE: Traefik does NOT interpolate environment variables in this file. Any
# secret must be a docker-compose label instead, where compose substitutes it
# from .env. That is why the CrowdSec bouncer is defined in docker-compose.yml.

api:
  dashboard: true
  debug: false

experimental:
  plugins:
    bouncer:
      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      version: v1.3.5
    geoblock:
      moduleName: github.com/PascalMinder/geoblock
      version: v0.2.8

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
          permanent: true
          # priority 1 keeps this redirect BELOW normal routers, which default
          # to a priority derived from rule length. That is what allows basil's
          # Host(`localhost`) HTTP router to keep serving without redirecting.
          # Do not raise this value.
          priority: 1
  https:
    address: ":443"

# Backends here use self-signed certs (harbor, etc). This disables verification
# of upstream TLS for ALL services — matches prod, but it is a real weakening.
# Prefer per-service serversTransport if you ever narrow this.
serversTransport:
  insecureSkipVerify: true

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik
    httpClientTimeout: 0
  file:
    filename: /config.yml
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: pkartch@gmail.com
      storage: acme.json
      # HTTP-01: public port 80 forwards to this host, so the challenge
      # reaches us directly. The dev host cannot use this — see traefik.dev.yml.
      httpChallenge:
        entryPoint: http

log:
  level: INFO

accessLog:
  filePath: "/var/log/traefik/access.log"