# Ingress / Traefik

This stack adds an internal Traefik layer on PD.

Why this exists:
- keep Pangolin as the public tunnel/edge from the VPS
- centralize app routing behind one internal reverse proxy
- put centralized auth in front of selected apps with domain-based policy when needed
- fix browser cert pain for apps like Technitium by terminating the public HTTPS edge before the self-signed backend
- avoid giving Traefik Docker socket access; routes are explicit file-provider config

Design choices:
- Traefik is internal-only on the `pangolin` Docker network
- no host port publishing
- no ACME on PD
- no Docker provider / no docker.sock mount
- Pangolin resources should target `traefik:80` on site 4 when an app is cut over to this layer
- Authelia remains the identity decision point for `auth.paccoco.com` while migrated apps can use either Traefik forward-auth or app-native OIDC depending on the service.

Current routed hostnames in dynamic config:
- `auth.paccoco.com` -> Authelia
- `gitea.paccoco.com` -> Gitea
- `grafana.paccoco.com` -> Grafana
- `dns.paccoco.com` -> Technitium (native OIDC inside the app)
- `traefik.paccoco.com` -> Traefik dashboard

Cutover note:
- Deploying this stack does not automatically rewrite Pangolin resources.
- The secure end state is: Pangolin tunnel -> Traefik -> app.
- If an existing Pangolin resource still points directly at an app, that app will keep behaving the old way until its target is changed.