fix(traefik): expose API on an internal-only entrypoint for container-to-container access

The public traefik.pivoine.art path round-trips through the host's published port, and Docker's hairpin NAT there rewrites the source IP before it reaches vpn-only's allowlist, so pulsenode's own request was getting a 403 despite falcon_network being allowlisted. Port 8080 is not published to the host, so it's reachable only from other falcon_network containers - no TLS/vpn-only needed, and it's not exposed externally.
2026-08-17 19:29:43 +02:00
parent bed01b4fdf
commit 3761924242
2 changed files with 11 additions and 1 deletions
@@ -12,7 +12,7 @@ groups:

      - type: traefik
        name: Traefik
-        apiUrl: https://traefik.pivoine.art/api
+        apiUrl: http://traefik:8080/api
        interval: 15s

      - type: docker