streamline traefik dashboard routing: docker labels instead of file provider

Switches traefik.pivoine.art routing from a standalone file-provider
router (dynamic/dashboard.yaml) to docker-compose labels on traefik's
own service - the same pattern every other stack already uses for its
own routing, rather than a one-off exception. Traefik discovers itself
just like any other container on falcon_network. Both routers point
at the built-in api@internal service via .service= instead of a
loadbalancer target, since there's no backend container port to route
to. Also dropped the (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
condition - the whole traefik.pivoine.art host is dedicated to this,
so a bare Host() match is simpler and no less correct.

Also fixes why VPN access still failed: traefik.pivoine.art was never
added to Headscale's MagicDNS extra_records, so even a tailnet-
connected browser resolved it via public DNS and hit vpn-only from a
non-tailnet source IP - same root cause as the earlier
pulsenode.pivoine.art fix, just missed for this hostname.

This commit is contained in:

valknar

2026-08-17 19:05:08 +02:00

parent 5d6a752f71

commit bed01b4fdf

3 changed files with 16 additions and 32 deletions

									
										headscale/config.yaml
									
		+3
		
												View File
												
				@@ -69,6 +69,9 @@ dns:

				    - name: "pulsenode.pivoine.art"

				      type: "A"

				      value: "100.64.0.3"

				    - name: "traefik.pivoine.art"

				      type: "A"

				      value: "100.64.0.3"

				# TLS is terminated by Traefik; headscale itself serves plain HTTP internally.

				tls_letsencrypt_hostname: ""