# =============================================================================
# Traefik Static Configuration
# You generally do not need to change anything in this file except the section
# marked with "CONFIGURE" below.
# =============================================================================

# --- No changes needed -------------------------------------------------------
api:
    dashboard: true
    insecure: true # Dashboard on port 8080 - only accessible via WireGuard

entryPoints:
    web:
        address: ":80"
        http:
            redirections:
                entryPoint:
                    to: websecure
                    scheme: https
    websecure:
        address: ":443"
    # Add extra TCP/UDP entrypoints here if you need to expose non-HTTP services
    # my-tcp:
    #     address: ":PORT"

providers:
    file:
        filename: /etc/traefik/dynamic.yml
        watch: true

tls:
    options:
        default:
            sniStrict: true # Rejects TLS connections for unknown hostnames
# -----------------------------------------------------------------------------

# --- CONFIGURE ---------------------------------------------------------------
certificatesResolvers:
    letsencrypt:
        acme:
            email: YOUR_EMAIL_HERE@EMAIL.COM  # <-- change this
            storage: /letsencrypt/acme.json
            httpChallenge:
                entryPoint: web
# -----------------------------------------------------------------------------