48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
|
# Shared multi-tenant mode: one wildcard cert for *.<GATEWAY_BASE_DOMAIN>,
|
||
|
|
# issued once via DNS-01, used as the default cert for every router. This
|
||
|
|
# avoids Let's Encrypt's ~50-certs/registered-domain/week limit that
|
||
|
|
# per-subdomain HTTP-01 would blow through at real shared-tenant volume.
|
||
|
|
#
|
||
|
|
# DNS-01 needs a provider. Traefik reads provider credentials from
|
||
|
|
# provider-specific env vars (e.g. CF_DNS_API_TOKEN for Cloudflare) passed
|
||
|
|
# through to the traefik container — see
|
||
|
|
# https://doc.traefik.io/traefik/https/acme/#providers for the full list.
|
||
|
|
# `provider:` below is a placeholder; set it to whatever DNS host actually
|
||
|
|
# serves GATEWAY_BASE_DOMAIN for the real shared deployment.
|
||
|
|
#
|
||
|
|
# The wildcard cert itself is requested via a dynamic-config
|
||
|
|
# `tls.stores.default.defaultGeneratedCert` entry (traefik/dynamic/), since
|
||
|
|
# it needs GATEWAY_BASE_DOMAIN interpolated at deploy time — see
|
||
|
|
# ops/deploy.sh.
|
||
|
|
|
||
|
|
entryPoints:
|
||
|
|
web:
|
||
|
|
address: ":80"
|
||
|
|
http:
|
||
|
|
redirections:
|
||
|
|
entryPoint:
|
||
|
|
to: websecure
|
||
|
|
scheme: https
|
||
|
|
websecure:
|
||
|
|
address: ":443"
|
||
|
|
|
||
|
|
providers:
|
||
|
|
file:
|
||
|
|
directory: /etc/traefik/dynamic
|
||
|
|
watch: true
|
||
|
|
|
||
|
|
certificatesResolvers:
|
||
|
|
le-dns:
|
||
|
|
acme:
|
||
|
|
email: admin@example.com # overridden per-deployment; see ops/deploy.sh
|
||
|
|
storage: /acme/acme.json
|
||
|
|
dnsChallenge:
|
||
|
|
provider: cloudflare # placeholder — set to the real deployment's DNS provider
|
||
|
|
|
||
|
|
api:
|
||
|
|
dashboard: false
|
||
|
|
insecure: false
|
||
|
|
|
||
|
|
log:
|
||
|
|
level: INFO
|