From a54fdcb24cbd288c7b55e4eb0aa1a24949c4a8fc Mon Sep 17 00:00:00 2001 From: david Date: Fri, 7 Aug 2026 13:30:45 +0200 Subject: [PATCH] feat(deploy): terminate TLS at traefik for the gateway host via Let's Encrypt api.marketplace.vector.apexfusion.org is no longer Cloudflare-proxied, so traefik now terminates TLS itself: a websecure router with the letsencrypt ACME resolver, and the :80 router demoted to a permanent HTTPS redirect. Other hosts on the box stay Cloudflare-terminated on :80. Co-Authored-By: Claude Fable 5 --- deploy/mainnet/docker-compose.gateway.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/deploy/mainnet/docker-compose.gateway.yml b/deploy/mainnet/docker-compose.gateway.yml index e9652a5..09b1256 100644 --- a/deploy/mainnet/docker-compose.gateway.yml +++ b/deploy/mainnet/docker-compose.gateway.yml @@ -59,8 +59,18 @@ services: labels: - "traefik.enable=true" - "traefik.docker.network=traefik-net" + # This host is NOT Cloudflare-proxied: traefik terminates TLS itself with + # a Let's Encrypt cert (resolver defined in /root/traefik/traefik.yml on + # the box). The :80 router only redirects; ACME HTTP-01 challenges are + # answered by traefik before the redirect applies. - "traefik.http.routers.mp-gateway-mainnet.entrypoints=web" - "traefik.http.routers.mp-gateway-mainnet.rule=Host(`api.marketplace.vector.apexfusion.org`)" + - "traefik.http.routers.mp-gateway-mainnet.middlewares=mp-gateway-mainnet-https" + - "traefik.http.middlewares.mp-gateway-mainnet-https.redirectscheme.scheme=https" + - "traefik.http.middlewares.mp-gateway-mainnet-https.redirectscheme.permanent=true" + - "traefik.http.routers.mp-gateway-mainnet-tls.entrypoints=websecure" + - "traefik.http.routers.mp-gateway-mainnet-tls.rule=Host(`api.marketplace.vector.apexfusion.org`)" + - "traefik.http.routers.mp-gateway-mainnet-tls.tls.certresolver=letsencrypt" - "traefik.http.services.mp-gateway-mainnet.loadbalancer.server.port=8080" logging: driver: json-file