truenas-stacks/ingress

Ingress / Traefik

This stack adds an internal Traefik layer on PD.

Why this exists:

• keep Pangolin as the public tunnel/edge from the VPS
• centralize app routing behind one internal reverse proxy
• put Authelia in front of selected apps with domain-based policy
• fix browser cert pain for apps like Technitium by terminating the public HTTPS edge before the self-signed backend
• avoid giving Traefik Docker socket access; routes are explicit file-provider config

Design choices:

• Traefik is internal-only on the pangolin Docker network
• no host port publishing
• no ACME on PD
• no Docker provider / no docker.sock mount
• Pangolin resources should target traefik:80 on site 4 when an app is cut over to this layer
• Authelia remains the identity decision point for domain/group access

Current routed hostnames in dynamic config:

• auth.paccoco.com -> Authelia
• gitea.paccoco.com -> Gitea (Authelia-protected)
• grafana.paccoco.com -> Grafana (Authelia-protected)
• dns.paccoco.com -> Technitium (Authelia-protected)
• traefik.paccoco.com -> Traefik dashboard (Authelia-protected)

Cutover note:

• Deploying this stack does not automatically rewrite Pangolin resources.
• The secure end state is: Pangolin tunnel -> Traefik -> app.
• If an existing Pangolin resource still points directly at an app, that app will keep behaving the old way until its target is changed.