refactored dynamic traefik conf files

Removed let's encrypt acme and other stuff. Using Cloudflare origin CA

traefik/dynamic/dynamic.yml

@@ -1,6 +1,6 @@
 http:
   routers:
-    # Traefik Dashboard
+    # Traefik Dashboard (локальный)
     traefik-dashboard:
       rule: "Host(`traefik.workstation`)"
       entryPoints:
@@ -10,9 +10,8 @@ http:
         # - auth
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
 
-    # Portainer
+    # Portainer (публичный)
     portainer:
       rule: "Host(`portainer.forust.xyz`)"
       entryPoints:
@@ -20,10 +19,9 @@ http:
       service: portainer
       middlewares:
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
-    # AdGuard Home
+    # AdGuard Home (публичный)
     adguard:
       rule: "Host(`adguard.forust.xyz`)"
       entryPoints:
@@ -31,8 +29,7 @@ http:
       service: adguard
       middlewares:
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
     # Nextcloud AIO Interface (локальный)
     nextcloud-aio:
@@ -44,7 +41,7 @@ http:
         - security-headers
       tls: {}
 
-    # Nextcloud Main
+    # Nextcloud Main (публичный)
     nextcloud:
       rule: "Host(`nextcloud.forust.xyz`)"
       entrypoints:
@@ -52,10 +49,9 @@ http:
       service: nextcloud
       middlewares:
         - nextcloud-chain
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
-    # Dockmon
+    # Dockmon (публичный)
     dockmon:
       rule: "Host(`dockmon.forust.xyz`)"
       entryPoints:
@@ -64,8 +60,7 @@ http:
       middlewares:
         # - dockmon-auth
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
     # Glance (локальный)
     glance:
@@ -87,7 +82,7 @@ http:
         - security-headers
       tls: {}
 
-    # N8N
+    # N8N (локальный)
     n8n:
       rule: "Host(`n8n.workstation`)"
       entryPoints:
@@ -96,9 +91,8 @@ http:
       middlewares:
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
 
-    # Gitea
+    # Gitea (публичный)
     gitea:
       rule: "Host(`gitea.forust.xyz`)"
       entryPoints:
@@ -106,8 +100,7 @@ http:
       service: gitea
       middlewares:
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
   services:
     # Portainer
@@ -247,4 +240,30 @@ http:
       chain:
         middlewares:
           - nextcloud-secure-headers
-          - security-headers
+          - security-headers
+
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA для публичных доменов *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+    # Локальный сертификат для *.workstation
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        # По умолчанию используем локальный сертификат
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

traefik/dynamic/tls.yml

@@ -1,19 +0,0 @@
-tls:
-  certificates:
-    - certFile: /certs/workstation+1.pem
-      keyFile: /certs/workstation+1-key.pem
-  stores:
-    default:
-      defaultCertificate:
-        certFile: /certs/cloudflare.pem
-        keyFile: /certs/cloudflare.key
-
-  
-  options:
-    default:
-      minVersion: VersionTLS12
-      sniStrict: true
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305