# Traefik dynamic config (file provider) — route the admin UI hostname to the
# fleet-manager, which runs in behind-proxy mode (plaintext on loopback :9500,
# passkey auth ON; Traefik terminates the LE cert).
#
# ONLY the admin plane rides Traefik. The agent gRPC/mTLS plane (:9600) is NOT
# here — Traefik can't terminate the fleet-CA client-cert mTLS; hosts reach it
# directly (host VLAN -> OPNsense L3 -> manager:9600). See DEPLOY.md.
#
# Change the Host() rule to your admin-UI hostname (== FLEET_MGR_RP_ID). File
# config isn't env-interpolated, so this is set per-deployment.
http:
  routers:
    fleet-admin:
      rule: "Host(`diskless-server.bitasylum.org`)"
      entryPoints:
        - websecure
      service: fleet-admin
      tls:
        certResolver: le

  services:
    fleet-admin:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:9500"   # manager, behind-proxy plaintext (loopback)
        passHostHeader: true               # preserve Host so WebAuthn RP origin matches