38 lines
862 B
YAML
38 lines
862 B
YAML
# Traefik dynamic configuration — hot-reloaded by Traefik on change.
|
|
#
|
|
# TLS: private CA server cert + mandatory client cert (mTLS).
|
|
# Any connection without a valid client cert signed by ca.crt is rejected
|
|
# at the TLS handshake — before any HTTP reaches EMS.
|
|
|
|
tls:
|
|
certificates:
|
|
- certFile: /certs/server.crt
|
|
keyFile: /certs/server.key
|
|
|
|
options:
|
|
mtls:
|
|
clientAuth:
|
|
caFiles:
|
|
- /certs/ca.crt
|
|
clientAuthType: RequireAndVerifyClientCert
|
|
# Minimum TLS 1.2; prefer 1.3
|
|
minVersion: VersionTLS12
|
|
sniStrict: true
|
|
|
|
http:
|
|
routers:
|
|
ems:
|
|
rule: "Host(`ems.famfi.dyndns.org`)"
|
|
entryPoints:
|
|
- websecure
|
|
tls:
|
|
options: mtls
|
|
service: ems
|
|
|
|
services:
|
|
ems:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://ems:9099"
|
|
passHostHeader: true
|