From fdca4911ae45575c3e7648e7bf3377c1490c1b6b Mon Sep 17 00:00:00 2001
From: hsiegeln <37154749+hsiegeln@users.noreply.github.com>
Date: Tue, 7 Apr 2026 00:21:12 +0200
Subject: [PATCH] fix: admin console via Traefik port 3002 without forced TLS

Remove tls=true from the logto-console router so the entrypoint
accepts plain HTTP. Logto's internal self-calls via ADMIN_ENDPOINT
use HTTP and pass through Traefik transparently. Browsers can
access via HTTP on port 3002.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 docker-compose.dev.yml | 1 -
 docker-compose.yml     | 3 +--
 traefik.yml            | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 580577f..feb22f6 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -8,7 +8,6 @@ services:
   logto:
     ports:
       - "3001:3001"
-      - "3002:3002"
 
   cameleer-saas:
     ports:
diff --git a/docker-compose.yml b/docker-compose.yml
index 0b77045..9d12570 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,7 +30,7 @@ services:
     ports:
       - "80:80"
       - "443:443"
-      - "3443:3443"
+      - "3002:3002"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./traefik.yml:/etc/traefik/traefik.yml:ro
@@ -84,7 +84,6 @@ services:
       - traefik.http.services.logto.loadbalancer.server.port=3001
       - traefik.http.routers.logto-console.rule=PathPrefix(`/`)
       - traefik.http.routers.logto-console.entrypoints=admin-console
-      - traefik.http.routers.logto-console.tls=true
       - traefik.http.routers.logto-console.service=logto-console
       - traefik.http.services.logto-console.loadbalancer.server.port=3002
     networks:
diff --git a/traefik.yml b/traefik.yml
index 716ef8a..27df844 100644
--- a/traefik.yml
+++ b/traefik.yml
@@ -12,7 +12,7 @@ entryPoints:
   websecure:
     address: ":443"
   admin-console:
-    address: ":3443"
+    address: ":3002"
 
 providers:
   docker: