furtka-gateway/traefik/dynamic/control-plane.yml.example

# Copy to traefik/dynamic/control-plane.yml (into whatever directory YOUR
# Traefik's file provider watches — see the root README's Prerequisites
# checklist) with two placeholders substituted:
#
#   GATEWAY_CONTROL_PLANE_HOST  a real hostname you control (e.g.
#                               gw.example.com), with its own A/AAAA record
#                               pointing at this host.
#   GATEWAY_CONTROL_PLANE_TARGET  where YOUR Traefik actually reaches the
#                               control-plane container. If it joined your
#                               Traefik's docker network (ops/deploy.sh
#                               does this via `docker network connect` —
#                               the primary, recommended path), this is
#                               `furtka-gateway-control-plane:8090` — the
#                               container's fixed name, which Docker's
#                               embedded DNS resolves on any network it's
#                               joined to (unlike the compose *service*
#                               name `control-plane`, which is only
#                               guaranteed to resolve on networks compose
#                               itself manages — not one joined after the
#                               fact via a bare `docker network connect`).
#                               If instead you exposed it on a separate
#                               host (GATEWAY_CONTROL_PLANE_BIND widened
#                               beyond 127.0.0.1 in docker-compose.yaml),
#                               this is that host's real reachable
#                               `host:port` — see ops/deploy.sh's warning
#                               about the access-control implication of
#                               that path.
#
# Without this file, the control-plane API is only reachable at
# 127.0.0.1:8090 on this host itself — fine for a local health check,
# useless for a real remote Furtka box, which needs this over HTTPS
# anyway: the registration response carries a WireGuard private key in
# plaintext JSON, so that call must never go out over bare HTTP.
#
# GATEWAY_MODE=single: keep the certResolver line below, set to whatever
# resolver name YOUR Traefik already has configured (blank/omit the `tls:`
# block entirely if your Traefik applies a default cert automatically —
# see GATEWAY_CERT_RESOLVER in .env.example, which controls this same
# choice for every *app* route furtka-gateway publishes; keep both
# consistent).
# GATEWAY_MODE=shared: delete the `tls:` block entirely — the shared
# wildcard defaultGeneratedCert (traefik/dynamic/default-cert.yml) already
# covers every hostname under GATEWAY_BASE_DOMAIN, this included.
http:
  routers:
    control-plane:
      rule: "Host(`GATEWAY_CONTROL_PLANE_HOST`)"
      entryPoints: [websecure]
      service: control-plane
      tls:
        certResolver: le
  services:
    control-plane:
      loadBalancer:
        servers:
          - url: "http://GATEWAY_CONTROL_PLANE_TARGET"