From dc7fe64fbcecaa6325e877ef23585051820ae302 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Tue, 30 Dec 2025 22:44:52 +0100
Subject: [PATCH] fix: clean up traefik configuration and add redirect
 middleware

---
 .gitignore                      |  1 +
 adguardhome/compose.yaml        |  1 -
 traefik/compose.yaml            |  7 ++-----
 traefik/dynamic/middlewares.yml | 28 ----------------------------
 traefik/dynamic/redirect.yml    | 23 +++++++++++++++++++++++
 5 files changed, 26 insertions(+), 34 deletions(-)
 create mode 100644 traefik/dynamic/redirect.yml

diff --git a/.gitignore b/.gitignore
index 7d81695..5e00c81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -83,3 +83,4 @@ replacements.txt
 
 # Temp files
 edu_master/temp/
+temp/*
diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml
index 0224100..7582125 100644
--- a/adguardhome/compose.yaml
+++ b/adguardhome/compose.yaml
@@ -45,7 +45,6 @@ services:
       - "traefik.http.routers.dns.entrypoints=websecure"
       - "traefik.http.routers.dns.service=adguard"
       - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.dns.tls=true"
 
       - glance.name=adguard
       - glance.url=https://adguard.forust.xyz/
diff --git a/traefik/compose.yaml b/traefik/compose.yaml
index cdf4096..eff00c3 100644
--- a/traefik/compose.yaml
+++ b/traefik/compose.yaml
@@ -19,17 +19,14 @@ services:
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.ssh.address=:2221"
 
       # Let's Encrypt
       - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      # STAGING
-      - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+      # # STAGING
+      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
 
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
diff --git a/traefik/dynamic/middlewares.yml b/traefik/dynamic/middlewares.yml
index 28d552b..0dba63f 100644
--- a/traefik/dynamic/middlewares.yml
+++ b/traefik/dynamic/middlewares.yml
@@ -1,33 +1,5 @@
 http:
   middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-
     # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:
diff --git a/traefik/dynamic/redirect.yml b/traefik/dynamic/redirect.yml
new file mode 100644
index 0000000..fdcea94
--- /dev/null
+++ b/traefik/dynamic/redirect.yml
@@ -0,0 +1,23 @@
+http:
+  middlewares:
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
+
+    http-catchall:
+      rule: "HostRegexp(`{host:.+}`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-https
+      service: noop@internal
+      priority: 1