# Traefik static configuration: the server-wide edge for every stack under
# stacks/. Changing anything in static/ changes TRAEFIK_CONFIG_HASH, so deploy.sh
# recreates the container; ../dynamic/ is watched and applies without a restart.
global:
  checkNewVersion: false
  sendAnonymousUsage: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"
  # Internal only (not published): serves /ping for the healthcheck.
  traefik:
    address: ":8080"

certificatesResolvers:
  le:
    acme:
      # No e-mail: Let's Encrypt no longer sends expiry mail, and renewal is
      # automatic. deploy.sh checks the certificates on every deploy.
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: web

# The dashboard is served at traefik.petrolyst.com through api@internal, behind
# Keycloak (labels on the traefik service in compose.yaml). No insecure port.
api:
  dashboard: true

ping:
  entryPoint: traefik

providers:
  docker:
    # Through docker-socket-proxy (read-only container listing and events);
    # Traefik never mounts the Docker socket itself.
    endpoint: tcp://socket-proxy:2375
    exposedByDefault: false
    network: proxy
  file:
    directory: /etc/traefik/dynamic
    watch: true

log:
  level: INFO
  format: json

accessLog:
  format: json