From 8c6c01b9165670d230a82bd5805048d52df0c596 Mon Sep 17 00:00:00 2001
From: kovagoadi <kovagoadi@gmail.com>
Date: Sat, 20 Dec 2025 15:12:51 +0100
Subject: [PATCH] Setup env (#24)

Reviewed-on: https://gitea.kovagoadi.hu/kovagoadi.hu/traefik/pulls/24
Co-authored-by: kovagoadi <kovagoadi@gmail.com>
Co-committed-by: kovagoadi <kovagoadi@gmail.com>
---
 dev.env                           |  4 +++-
 docker-compose.yaml               |  3 +++
 prod.env                          |  1 +
 prod/forward-to-legacy-nginx.yaml | 16 ++++++++++++----
 staging.env                       |  1 +
 5 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/dev.env b/dev.env
index e42f23f..6b520c4 100644
--- a/dev.env
+++ b/dev.env
@@ -4,4 +4,6 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
\ No newline at end of file
+ACME_BYPASS=false
+TRAEFIK_LEGACY_OPT=
+# TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
\ No newline at end of file
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 4c77b64..d0ab6a3 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -13,6 +13,7 @@ services:
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
       - "--entryPoints.web.address=:80"
       - "--entryPoints.https.address=:443"
+      - "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
@@ -37,7 +38,9 @@ services:
     labels:
       - "env=${ENV}"
       - "traefik.enable=true"
+      - "traefik.http.routers.whoami.priority=100"
       - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
+      - "traefik.http.routers.https.priority=100"
       - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
       - "traefik.http.routers.whoami.entrypoints=web"
       - traefik.http.routers.https.entrypoints=https
diff --git a/prod.env b/prod.env
index 302deeb..9a3f01a 100644
--- a/prod.env
+++ b/prod.env
@@ -4,4 +4,5 @@ ENV=prod
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
+ACME_BYPASS=true
 TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
\ No newline at end of file
diff --git a/prod/forward-to-legacy-nginx.yaml b/prod/forward-to-legacy-nginx.yaml
index e184fe0..4da1e72 100644
--- a/prod/forward-to-legacy-nginx.yaml
+++ b/prod/forward-to-legacy-nginx.yaml
@@ -9,7 +9,7 @@ tcp:
       # Passthrough must be true for SSL to reach Nginx encrypted
       tls:
         passthrough: true
-      priority: 1
+      priority: 10
       entryPoints:
         - "https"
 
@@ -23,12 +23,20 @@ tcp:
 
 http:
   routers:
-    # Router for HTTP
+    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
+    traefik-acme-handler:
+      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
+      entryPoints:
+        - "web"
+      service: "acme-http@internal" # This is the internal service name
+      priority: 1000                # High priority to ensure it wins
+
+    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
     nginx-legacy-router:
       rule: "HostRegexp(`^.+$`)"
       service: nginx-legacy-service
-      # Low priority ensures specific containers are handled first
-      priority: 1
+      # Low priority ensures specific containers are handled first, but before the default acme-handler
+      priority: 90
       entryPoints:
         - "web"
 
diff --git a/staging.env b/staging.env
index 38ab2dc..587707c 100644
--- a/staging.env
+++ b/staging.env
@@ -4,4 +4,5 @@ ENV=staging
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
+ACME_BYPASS=false
 TRAEFIK_LEGACY_OPT=
\ No newline at end of file