# Shared multi-tenant mode: one wildcard cert for *.<GATEWAY_BASE_DOMAIN>,
# issued once via DNS-01, used as the default cert for every router. This
# avoids Let's Encrypt's ~50-certs/registered-domain/week limit that
# per-subdomain HTTP-01 would blow through at real shared-tenant volume.
#
# DNS-01 needs a provider. Traefik reads provider credentials from
# provider-specific env vars (e.g. CF_DNS_API_TOKEN for Cloudflare) passed
# through to the traefik container — see
# https://doc.traefik.io/traefik/https/acme/#providers for the full list.
# `provider:` below is a placeholder; set it to whatever DNS host actually
# serves GATEWAY_BASE_DOMAIN for the real shared deployment.
#
# The wildcard cert itself is requested via a dynamic-config
# `tls.stores.default.defaultGeneratedCert` entry (traefik/dynamic/), since
# it needs GATEWAY_BASE_DOMAIN interpolated at deploy time — see
# ops/deploy.sh.

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

providers:
  file:
    directory: /etc/traefik/dynamic
    watch: true

certificatesResolvers:
  le-dns:
    acme:
      email: admin@example.com # overridden per-deployment; see ops/deploy.sh
      storage: /acme/acme.json
      dnsChallenge:
        provider: cloudflare # placeholder — set to the real deployment's DNS provider

api:
  dashboard: false
  insecure: false

log:
  level: INFO