9163f919c8
Traefik v3 ignores tls.stores.default in the static config, causing it to serve its auto-generated fallback cert instead of the platform cert. Moving the default certificate store to the dynamic config (file provider) fixes this — Traefik now serves the correct cert and also picks up cert rotations without a restart. This was the root cause of OIDC PKIX failures: the server imported the CA into its JVM truststore, but Traefik was serving a different cert entirely. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
25 lines
510 B
YAML
25 lines
510 B
YAML
http:
|
|
routers:
|
|
root-redirect:
|
|
rule: "Path(`/`)"
|
|
priority: 100
|
|
entryPoints:
|
|
- websecure
|
|
tls: {}
|
|
middlewares:
|
|
- root-to-platform
|
|
service: saas@docker
|
|
middlewares:
|
|
root-to-platform:
|
|
redirectRegex:
|
|
regex: "^(https?://[^/]+)/?$"
|
|
replacement: "${1}/platform/"
|
|
permanent: false
|
|
|
|
tls:
|
|
stores:
|
|
default:
|
|
defaultCertificate:
|
|
certFile: /etc/traefik/certs/cert.pem
|
|
keyFile: /etc/traefik/certs/key.pem
|