bisco/loadbalancer
1
0
Fork 0
generated from bisco/codex-bootstrap
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add http challenge routing

Browse Source
This commit is contained in:
Alfredo Di Stasio
2026-06-30 10:09:35 +02:00
parent b5beb27623
commit f3759e76ea
11 changed files with 78 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations.md
+3
View File
@@ -50,8 +50,11 @@ To remove a backend from rotation, edit `config/dynamic/tcp-services.yml` and re
For backends running on the Docker host, use `host.docker.internal:PORT` rather than `127.0.0.1:PORT`, because `127.0.0.1` inside the container refers to the container itself.
For HTTP-01 challenges, update the `*-acme` HTTP services in `config/dynamic/tcp-services.yml` to match the local challenge responder ports.
## Known operational risks
- TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
- Backend certificates and renewal jobs must be monitored on each backend.
- SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
- Public port `80/tcp` is only intended for `/.well-known/acme-challenge/` traffic in this configuration.