Merge branch 'main' into fix-acme

dev.env

@@ -4,4 +4,4 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
+TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"

dev/forward-to-legacy-nginx.yaml

@@ -0,0 +1,56 @@
+# ./traefik/forward-to-legacy-nginx.yaml
+
+    
+# static configuration (traefik.yml)
+# entryPoints:
+#   web:
+#     address: ":80" # or :898 in your case
+#     allowACMEByPass: true  # <--- WITHOUT THIS, TRAEFIK ALWAYS WINS
+#   https:
+#     address: ":443"
+
+# certificatesResolvers:
+#   letsencrypt:
+#     acme:
+#       email: "[email protected]"
+#       storage: "acme.json"
+#       httpChallenge:
+#        entryPoint: web
+
+tcp:
+  routers:
+    # Router for LEGACY HTTPS (Passthrough)
+    nginx-legacy-router-secure:
+      # DO NOT use "*". List the domains that Nginx manages itself.
+      # If you use "*", Traefik's own HTTPS domains will not work.
+      rule: "HostSNI(`excali.kovagoadi.hu`) || HostSNI(`another-legacy.hu`)"
+      service: nginx-legacy-service-secure
+      tls:
+        passthrough: true
+      priority: 1
+      entryPoints:
+        - "https"
+
+  services:
+    nginx-legacy-service-secure:
+      loadBalancer:
+        servers:
+          - address: "webserver:443"
+
+http:
+  routers:
+    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
+
+    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
+    nginx-legacy-router:
+      rule: "HostRegexp(`^.+$`)"
+      service: nginx-legacy-service
+      entryPoints:
+        - "web"
+      priority: 1 
+
+  services:
+    nginx-legacy-service:
+      loadBalancer:
+        servers:
+          - url: "http://webserver:80"

docker-compose.yaml

@@ -1,11 +1,12 @@
 services:
-  traefik:
+  traefik3:
     image: "traefik:v3.6@sha256:67622638cd88dbfcfba40159bc652ecf0aea0e032f8a3c7e3134ae7c037b9910"
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
     networks:
       - proxy
+      - legacy-nginx
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -13,11 +14,11 @@ services:
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
       - "--entryPoints.web.address=:80"
       - "--entryPoints.https.address=:443"
+      - "--entryPoints.web.allowACMEByPass=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
       - "${TRAEFIK_LEGACY_OPT:-}"
       - "--providers.file.watch=true"
     ports:
@@ -37,13 +38,16 @@ services:
     labels:
       - "env=${ENV}"
       - "traefik.enable=true"
+      - "traefik.http.routers.whoami.priority=10000"
       - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
       - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
       - "traefik.http.routers.whoami.entrypoints=web"
       - traefik.http.routers.https.entrypoints=https
       - traefik.http.routers.https.tls=true
-      - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
   proxy:
+  legacy-nginx:
+    name: proxy
+    external: true
 volumes:
   letsencrypt: