Latest Updates done, before integrating

infra/traefik/dynamic.yml

@@ -0,0 +1,37 @@
+# Traefik dynamic configuration — hot-reloaded by Traefik on change.
+#
+# TLS: private CA server cert + mandatory client cert (mTLS).
+# Any connection without a valid client cert signed by ca.crt is rejected
+# at the TLS handshake — before any HTTP reaches EMS.
+
+tls:
+  certificates:
+    - certFile: /certs/server.crt
+      keyFile:  /certs/server.key
+
+  options:
+    mtls:
+      clientAuth:
+        caFiles:
+          - /certs/ca.crt
+        clientAuthType: RequireAndVerifyClientCert
+      # Minimum TLS 1.2; prefer 1.3
+      minVersion: VersionTLS12
+      sniStrict: true
+
+http:
+  routers:
+    ems:
+      rule: "Host(`ems.famfi.dyndns.org`)"
+      entryPoints:
+        - websecure
+      tls:
+        options: mtls
+      service: ems
+
+  services:
+    ems:
+      loadBalancer:
+        servers:
+          - url: "http://ems:9099"
+        passHostHeader: true

infra/traefik/traefik.yml

@@ -0,0 +1,19 @@
+# Traefik static configuration
+# Handles TLS termination on port 9443 with private CA mTLS.
+# Dynamic routing config is in dynamic.yml (hot-reloaded on change).
+
+entryPoints:
+  websecure:
+    address: ":9443"
+
+providers:
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true          # reload dynamic.yml without container restart
+
+log:
+  level: INFO
+
+accessLog:
+  filePath: "/dev/stdout"
+  format: common