31 lines
1.4 KiB
Markdown
31 lines
1.4 KiB
Markdown
# Ingress / Traefik
|
|
|
|
This stack adds an internal Traefik layer on PD.
|
|
|
|
Why this exists:
|
|
- keep Pangolin as the public tunnel/edge from the VPS
|
|
- centralize app routing behind one internal reverse proxy
|
|
- put Authelia in front of selected apps with domain-based policy
|
|
- fix browser cert pain for apps like Technitium by terminating the public HTTPS edge before the self-signed backend
|
|
- avoid giving Traefik Docker socket access; routes are explicit file-provider config
|
|
|
|
Design choices:
|
|
- Traefik is internal-only on the `pangolin` Docker network
|
|
- no host port publishing
|
|
- no ACME on PD
|
|
- no Docker provider / no docker.sock mount
|
|
- Pangolin resources should target `traefik:80` on site 4 when an app is cut over to this layer
|
|
- Authelia remains the identity decision point for domain/group access
|
|
|
|
Current routed hostnames in dynamic config:
|
|
- `auth.paccoco.com` -> Authelia
|
|
- `gitea.paccoco.com` -> Gitea (Authelia-protected)
|
|
- `grafana.paccoco.com` -> Grafana (Authelia-protected)
|
|
- `dns.paccoco.com` -> Technitium (Authelia-protected)
|
|
- `traefik.paccoco.com` -> Traefik dashboard (Authelia-protected)
|
|
|
|
Cutover note:
|
|
- Deploying this stack does not automatically rewrite Pangolin resources.
|
|
- The secure end state is: Pangolin tunnel -> Traefik -> app.
|
|
- If an existing Pangolin resource still points directly at an app, that app will keep behaving the old way until its target is changed.
|