# Copy to traefik/dynamic/control-plane.yml with GATEWAY_CONTROL_PLANE_HOST
# substituted for a real hostname you control (e.g. gw.example.com, with its
# own A/AAAA record pointing at this VPS).
#
# Without this file, the control-plane API is only reachable at
# 127.0.0.1:8090 on the gateway host itself — fine for a local health
# check, useless for a real remote Furtka box, which needs this over HTTPS
# anyway: the registration response carries a WireGuard private key in
# plaintext JSON, so that call must never go out over bare HTTP.
#
# GATEWAY_MODE=single: keep the certResolver line below (HTTP-01 per host,
# same as every app route — see traefik.single.yml).
# GATEWAY_MODE=shared: delete the `tls:` block entirely — the shared
# wildcard defaultGeneratedCert (traefik/dynamic/default-cert.yml) already
# covers every hostname under GATEWAY_BASE_DOMAIN, this included.
http:
  routers:
    control-plane:
      rule: "Host(`GATEWAY_CONTROL_PLANE_HOST`)"
      entryPoints: [websecure]
      service: control-plane
      tls:
        certResolver: le
  services:
    control-plane:
      loadBalancer:
        servers:
          - url: "http://control-plane:8090"