truenas-stacks/ingress/README.md

Ingress / Traefik

This stack adds an internal Traefik layer on PD.

Why this exists:

• keep Pangolin as the public tunnel/edge from the VPS
• centralize app routing behind one internal reverse proxy
• put centralized auth in front of selected apps with domain-based policy when needed
• fix browser cert pain for apps like Technitium by terminating the public HTTPS edge before the self-signed backend
• avoid giving Traefik Docker socket access; routes are explicit file-provider config

Design choices:

• Traefik is internal-only on the pangolin Docker network
• no host port publishing
• no ACME on PD
• no Docker provider / no docker.sock mount
• Pangolin resources should target traefik:80 on site 4 when an app is cut over to this layer
• Authelia remains the identity decision point for auth.paccoco.com while migrated apps can use either Traefik forward-auth or app-native OIDC depending on the service.

Current routed hostnames in dynamic config:

• auth.paccoco.com -> Authelia
• gitea.paccoco.com -> Gitea
• grafana.paccoco.com -> Grafana
• dns.paccoco.com -> Technitium (native OIDC inside the app)
• traefik.paccoco.com -> Traefik dashboard

Cutover note:

• Deploying this stack does not automatically rewrite Pangolin resources.
• The secure end state is: Pangolin tunnel -> Traefik -> app.
• If an existing Pangolin resource still points directly at an app, that app will keep behaving the old way until its target is changed.