feat: add http challenge routing

2026-06-30 10:09:35 +02:00
parent b5beb27623
commit f3759e76ea
11 changed files with 78 additions and 9 deletions
@@ -28,6 +28,8 @@ tcp:

 If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.

+HTTP-01 certificate challenges are routed separately with HTTP `Host(...)` rules on port `80`. Configure the `*-acme` services in `config/dynamic/tcp-services.yml` to point at the local port where the challenge responder listens.
+
 The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:

 ```yaml
@@ -37,6 +39,7 @@ volumes:

 ## Ports

+- Host `80/tcp` -> container `8080/tcp`: public HTTP entrypoint for ACME HTTP-01 challenge paths.
 - Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
 - Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.