# Single-tenant mode: one operator's own domain, HTTP-01 challenge per
# subdomain. Fine at self-hosted scale — nowhere near Let's Encrypt's
# ~50-certs/registered-domain/week limit with a handful of published apps.

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

providers:
  file:
    directory: /etc/traefik/dynamic
    watch: true

certificatesResolvers:
  le:
    acme:
      email: admin@example.com # overridden per-deployment; see ops/deploy.sh
      storage: /acme/acme.json
      httpChallenge:
        entryPoint: web

api:
  dashboard: false
  insecure: false

log:
  level: INFO