e167d5475e
Standard OIDC architecture: subdomain routing (auth.HOST, server.HOST), TLS via Traefik, self-signed cert auto-generated on first boot. - Add traefik-certs init container (generates wildcard self-signed cert) - Enable TLS on all Traefik routers (websecure entrypoint) - HTTP→HTTPS redirect in traefik.yml - Host-based routing for all services (no more path conflicts) - PUBLIC_PROTOCOL env var (https default, configurable) - Protocol-aware redirect URIs in bootstrap - Protocol-aware UI fallbacks Customer bootstrap: set PUBLIC_HOST + DNS records + docker compose up. For production TLS, configure Traefik ACME (Let's Encrypt). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
27 lines
456 B
YAML
27 lines
456 B
YAML
api:
|
|
dashboard: false
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
|
|
providers:
|
|
docker:
|
|
endpoint: "unix:///var/run/docker.sock"
|
|
exposedByDefault: false
|
|
network: cameleer
|
|
|
|
tls:
|
|
stores:
|
|
default:
|
|
defaultCertificate:
|
|
certFile: /etc/traefik/certs/cert.pem
|
|
keyFile: /etc/traefik/certs/key.pem
|