Merge branch 'main' into fix-acme

dev.env

@@ -4,4 +4,4 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
+TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"

dev/forward-to-legacy-nginx.yaml

@@ -0,0 +1,54 @@
+# ./traefik/forward-to-legacy-nginx.yaml
+
+entryPoints:
+  web:
+    # Essential: Allows your routers to intercept /.well-known/acme-challenge/
+    allowACMEByPass: true
+
+tcp:
+  routers:
+    # Router for HTTPS (Passthrough)
+    nginx-legacy-router-secure:
+      rule: "HostSNI(`*`)"
+      service: nginx-legacy-service-secure
+      # Passthrough must be true for SSL to reach Nginx encrypted
+      tls:
+        passthrough: true
+      priority: 1
+      entryPoints:
+        - "https"
+
+  services:
+    # Service defining the external IP
+    nginx-legacy-service-secure:
+      loadBalancer:
+        servers:
+          # This is the actual external IP and Port of your Nginx
+          - address: "webserver:443"
+
+http:
+  routers:
+    # 1. ROUTE FOR TRAEFIK-MANAGED DOMAINS
+    # For domains Traefik should handle, send challenges to the internal ACME service.
+    traefik-acme-handler:
+      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
+      entryPoints:
+        - "web"
+      service: "acme-http@internal" # This is the internal service name
+      priority: 1000                # High priority to ensure it wins
+
+    # 2. THE CATCH-ALL ROUTER (LEGACY)
+    # This remains your broad catch-all. Since it has lower priority,
+    # the one above handles the Traefik domains, and everything else hits this.
+    nginx-legacy-router:
+      rule: "HostRegexp(`^.+$`)"
+      service: nginx-legacy-service
+      entryPoints:
+        - "web"
+      priority: 1  # Will catch ACME for any domain NOT listed in the handler above
+
+  services:
+    nginx-legacy-service:
+      loadBalancer:
+        servers:
+          - url: "http://webserver:80"

docker-compose.yaml

@@ -6,6 +6,7 @@ services:
       - no-new-privileges:true
     networks:
       - proxy
+      - legacy-nginx
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -45,5 +46,8 @@ services:
       - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
   proxy:
+  legacy-nginx:
+    name: proxy
+    external: true
 volumes:
   letsencrypt: