Update traefik Docker tag to v3.6

2025-11-13 03:28:43 +00:00
10 changed files with 177 additions and 320 deletions
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -8,142 +8,202 @@ on:
    types: [opened, synchronize, reopened, closed]

 env:
-  # --- PATH CONFIGURATION ---
+  # Base path for PR preview environments
  REMOTE_DEPLOY_PATH: /var/app/traefik/test
+
+  # --- CUSTOMIZABLE PRODUCTION PATH ---
+  # Set the absolute path for your production deployment on the remote server.
  REMOTE_PROD_PATH: /var/app/traefik/prod
+
  REMOTE_STAGING_PATH: /var/app/traefik/staging

-  # --- SECRETS ---
  SSH_HOST: ${{ secrets.SSH_HOST }}
  SSH_USER: ${{ secrets.SSH_USER }}
  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}

 jobs:
-  # ------------------------------------------------------------------
-  # STAGE 1: PREPARE CONTEXT
-  # ------------------------------------------------------------------
-  prepare_context:
-    name: Prepare Context
+  prepare_deployment_vars:
+    name: Prepare deployment vars
    runs-on: ubuntu-latest
    outputs:
-      pr_path: ${{ steps.calc.outputs.pr_path }}
+      deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
    steps:
-      - id: calc
-        name: Prepare Context
+      - name: Set deployment variables
+        id: set-vars
        run: |
          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+            # For PRs, create a unique directory under the base path
+            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
+          else
+            # For 'main' branch, use the specified production path.
+            # Fallback to a default if REMOTE_PROD_PATH is empty.
+            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
          fi
+          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
+          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
+          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"

-  # ------------------------------------------------------------------
-  # STAGE 2: DEPLOY PREVIEW (DEV)
-  # ------------------------------------------------------------------
-  deploy_preview:
-    name: Deploy (Dev/Preview)
+  create_remote_directory:
+    name: Create remote directory
    runs-on: ubuntu-latest
-    needs: [prepare_context]
-    if: github.event_name == 'pull_request' && github.event.action != 'closed'
+    needs: prepare_deployment_vars
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+      || github.ref == 'refs/heads/main'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}

-      - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
-        env:
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ env.SSH_HOST }}
-          REMOTE_USER: ${{ env.SSH_USER }}
-          REMOTE_PORT: ${{ env.SSH_PORT }}
-          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
-          # Exclude git internals to save bandwidth
-          EXCLUDE: ".git/, .github/"
-          # 1. Create directory first
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
-          # 2. Run Docker Compose after sync
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ needs.prepare_context.outputs.pr_path }}
-            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts

-  # ------------------------------------------------------------------
-  # STAGE 3: DEPLOY STAGING
-  # ------------------------------------------------------------------
-  deploy_staging:
-    name: Deploy (Staging)
+      - name: Create directory on remote
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
+
+  sync_repo_files:
+    name: Sync repository files
    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    needs: [create_remote_directory, prepare_deployment_vars]
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+      || github.ref == 'refs/heads/main'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5

-      - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
-        env:
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ env.SSH_HOST }}
-          REMOTE_USER: ${{ env.SSH_USER }}
-          REMOTE_PORT: ${{ env.SSH_PORT }}
-          TARGET: ${{ env.REMOTE_STAGING_PATH }}
-          EXCLUDE: ".git/, .github/"
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ env.REMOTE_STAGING_PATH }}
-            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
-
-  # ------------------------------------------------------------------
-  # STAGE 4: DEPLOY PRODUCTION
-  # ------------------------------------------------------------------
-  deploy_prod:
-    name: Deploy (Production)
-    runs-on: ubuntu-latest
-    needs: [deploy_staging]
-    if: github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-      - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
-        env:
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ env.SSH_HOST }}
-          REMOTE_USER: ${{ env.SSH_USER }}
-          REMOTE_PORT: ${{ env.SSH_PORT }}
-          TARGET: ${{ env.REMOTE_PROD_PATH }}
-          EXCLUDE: ".git/, .github/"
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ env.REMOTE_PROD_PATH }}
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ env.REMOTE_PROD_PATH }}
-            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans
-
-  # ------------------------------------------------------------------
-  # CLEANUP (Using appleboy/ssh-action for pure command execution)
-  # ------------------------------------------------------------------
-  cleanup:
-    name: Cleanup Preview
-    runs-on: ubuntu-latest
-    needs: [prepare_context]
-    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
-    steps:
-      - name: Remove Remote Environment
-        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
+      - name: Sync files via scp
+        uses: appleboy/scp-action@master
        with:
          host: ${{ env.SSH_HOST }}
          username: ${{ env.SSH_USER }}
          key: ${{ env.SSH_PRIVATE_KEY }}
          port: ${{ env.SSH_PORT }}
-          script: |
-            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
-            if [ -d "$TARGET" ]; then
-              cd "$TARGET"
-              docker compose down -v || true
-              cd ..
-              rm -rf "$TARGET"
-              echo "Cleanup successful"
-            else
-              echo "Directory not found, skipping."
-            fi
+          source: "./"
+          target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+
+      - name: Sync file via scp (staging)
+        if: github.ref == 'refs/heads/main'
+        uses: appleboy/scp-action@master
+        with:
+          host: ${{ env.SSH_HOST }}
+          username: ${{ env.SSH_USER }}
+          key: ${{ env.SSH_PRIVATE_KEY }}
+          port: ${{ env.SSH_PORT }}
+          source: "./"
+          target: ${{ env.REMOTE_STAGING_PATH }}
+
+  run_docker_compose_dev:
+    name: Run docker-compose remotely (Dev)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
+
+  run_docker_compose_staging:
+    name: Run docker-compose remotely (Staging)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.ref == 'refs/heads/main')
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
+
+  run_docker_compose_prod:
+    name: Run docker-compose remotely (Prod)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.ref == 'refs/heads/main')
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
+
+  cleanup_mr_environment:
+    name: Cleanup MR environment
+    runs-on: ubuntu-latest
+    needs: prepare_deployment_vars
+    if: |
+      github.event_name == 'pull_request' && 
+      (github.event.action == 'closed' || github.event.pull_request.merged == true)
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose down on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
+
+      - name: Delete deployment directory
+        run: |
+          ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"
--- a/dev.env
+++ b/dev.env
@@ -1,9 +1,3 @@
 PORT=898
-HTTPS_PORT=446
 ENV=dev
-NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
-DOMAIN=dev.kovagoadi.hu
-ACME_BYPASS=false
-# TRAEFIK_LEGACY_OPT=
-TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
+NETWORK_NAME=proxy
--- a/dev/forward-to-legacy-nginx.yaml
+++ b/dev/forward-to-legacy-nginx.yaml
@@ -1,47 +0,0 @@
-# ./traefik/forward-to-legacy-nginx.yaml
-
-tcp:
-  routers:
-    # Router for HTTPS (Passthrough)
-    nginx-legacy-router-secure:
-      rule: "HostSNI(`*`)"
-      service: nginx-legacy-service-secure
-      # Passthrough must be true for SSL to reach Nginx encrypted
-      tls:
-        passthrough: true
-      priority: 10
-      entryPoints:
-        - "https"
-
-  services:
-    # Service defining the external IP
-    nginx-legacy-service-secure:
-      loadBalancer:
-        servers:
-          # This is the actual external IP and Port of your Nginx
-          - address: "webserver:443"
-
-http:
-  routers:
-    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
-    traefik-acme-handler:
-      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
-      entryPoints:
-        - "web"
-      service: "acme-http@internal" # This is the internal service name
-      priority: 1000                # High priority to ensure it wins
-
-    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
-    nginx-legacy-router:
-      rule: "HostRegexp(`^.+$`)"
-      service: nginx-legacy-service
-      # Low priority ensures specific containers are handled first, but before the default acme-handler
-      priority: 90
-      entryPoints:
-        - "web"
-
-  services:
-    nginx-legacy-service:
-      loadBalancer:
-        servers:
-          - url: "http://webserver:80"
--- a/dev/route-to-staging-dev.yaml
+++ b/dev/route-to-staging-dev.yaml
@@ -1,30 +0,0 @@
-http:
-  routers:
-    # Router for HTTP (Port 80)
-    staging:
-      rule: "Host(`staging.kovagoadi.hu`) || Host(`test-whoami.staging.kovagoadi.hu`)"
-      entryPoints:
-        - "web"
-      service: "dev-staging"
-      priority: 1000000
-
-    # Router for HTTPS (Port 443)
-    staging-secure:
-      rule: "Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
-      entryPoints:
-        - "https"
-      service: "dev-staging-secure"
-      priority: 100
-      tls: {} # <--- This enables TLS for this router
-
-  services:
-    dev-staging:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.85:8080"
-          
-    dev-staging-secure:
-      loadBalancer:
-        servers:
-          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
-          - url: "https://192.168.1.85:445"
--- a/docker-compose.prod.yaml
+++ b/docker-compose.prod.yaml
@@ -1,9 +0,0 @@
-services:
-  traefik:
-    networks:
-      - proxy
-      - legacy-nginx
-networks:
-  legacy-nginx:
-    name: proxy
-    external: true
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,57 +1,33 @@
 services:
  traefik:
-    image: "traefik:v3.6@sha256:67622638cd88dbfcfba40159bc652ecf0aea0e032f8a3c7e3134ae7c037b9910"
+    image: "traefik:v3.6@sha256:18112aed2bfe3dfb8534f1045622390c3316596cff0cefab64f44e43d23e1640"
+    # container_name: "traefik"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
-      - legacy-nginx
    command:
-      - "--log.level=DEBUG"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=proxy"
      - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
      - "--entryPoints.web.address=:80"
-      - "--entryPoints.https.address=:443"
-      - "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
-      - "${TRAEFIK_LEGACY_OPT:-}"
-      - "--providers.file.watch=true"
    ports:
      - "${PORT}:80"
-      - "${HTTPS_PORT}:443"
      - "8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "letsencrypt:/letsencrypt"
-      - "./${ENV}:/etc/traefik"

  whoami:
-    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
+    image: "traefik/whoami"
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "env=${ENV}"
      - "traefik.enable=true"
-      - "traefik.http.routers.whoami.priority=1000000"
-      - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
-      - "traefik.http.routers.https.priority=1000000"
-      - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
+      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
      - "traefik.http.routers.whoami.entrypoints=web"
-      - traefik.http.routers.https.entrypoints=https
-      - traefik.http.routers.https.tls=true
-      - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
  proxy:
-  legacy-nginx:
-    name: proxy
-    external: true
-volumes:
-  letsencrypt:
--- a/prod.env
+++ b/prod.env
@@ -1,8 +1,3 @@
-PORT=80
-HTTPS_PORT=443
+PORT=81
 ENV=prod
-NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
-DOMAIN=kovagoadi.hu
-ACME_BYPASS=true
-TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
+NETWORK_NAME=proxy
--- a/prod/forward-to-legacy-nginx.yaml
+++ b/prod/forward-to-legacy-nginx.yaml
@@ -1,47 +0,0 @@
-# ./traefik/forward-to-legacy-nginx.yaml
-
-tcp:
-  routers:
-    # Router for HTTPS (Passthrough)
-    nginx-legacy-router-secure:
-      rule: "HostSNI(`*`)"
-      service: nginx-legacy-service-secure
-      # Passthrough must be true for SSL to reach Nginx encrypted
-      tls:
-        passthrough: true
-      priority: 10
-      entryPoints:
-        - "https"
-
-  services:
-    # Service defining the external IP
-    nginx-legacy-service-secure:
-      loadBalancer:
-        servers:
-          # This is the actual external IP and Port of your Nginx
-          - address: "webserver:443"
-
-http:
-  routers:
-    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
-    traefik-acme-handler:
-      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
-      entryPoints:
-        - "web"
-      service: "acme-http@internal" # This is the internal service name
-      priority: 1000                # High priority to ensure it wins
-
-    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
-    nginx-legacy-router:
-      rule: "HostRegexp(`^.+$`)"
-      service: nginx-legacy-service
-      # Low priority ensures specific containers are handled first, but before the default acme-handler
-      priority: 90
-      entryPoints:
-        - "web"
-
-  services:
-    nginx-legacy-service:
-      loadBalancer:
-        servers:
-          - url: "http://webserver:80"
--- a/prod/route-to-staging-dev.yaml
+++ b/prod/route-to-staging-dev.yaml
@@ -1,30 +0,0 @@
-http:
-  routers:
-    # Router for HTTP (Port 80)
-    staging:
-      rule: "HostRegexp({subdomain:.+}.staging.kovagoadi.hu`) || Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
-      entryPoints:
-        - "web"
-      service: "dev-staging"
-      priority: 1_000_000
-
-    # Router for HTTPS (Port 443)
-    staging-secure:
-      rule: "Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
-      entryPoints:
-        - "https"
-      service: "dev-staging-secure"
-      priority: 100
-      tls: {} # <--- This enables TLS for this router
-
-  services:
-    dev-staging:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.1.85:8080"
-          
-    dev-staging-secure:
-      loadBalancer:
-        servers:
-          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
-          - url: "https://192.168.1.85:445"
--- a/staging.env
+++ b/staging.env
@@ -1,8 +1,3 @@
 PORT=8080
-HTTPS_PORT=445
 ENV=staging
-NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
-DOMAIN=staging.kovagoadi.hu
-ACME_BYPASS=false
-TRAEFIK_LEGACY_OPT=
+NETWORK_NAME=proxy