Trying this config

dev/forward-to-legacy-nginx.yaml

@@ -1,9 +1,13 @@
 # ./traefik/forward-to-legacy-nginx.yaml
 
+    
+# static configuration (traefik.yml)
 entryPoints:
   web:
-    # Essential: Allows your routers to intercept /.well-known/acme-challenge/
-    allowACMEByPass: true
+    address: ":80" # or :898 in your case
+    allowACMEByPass: true  # <--- WITHOUT THIS, TRAEFIK ALWAYS WINS
+
+  
 
 tcp:
   routers:

docker-compose.yaml

@@ -12,7 +12,6 @@ services:
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=proxy"
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
-      - "--entryPoints.web.address=:80"
       - "--entryPoints.https.address=:443"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"