From e26002a62e3f95c04ba1b2ade94d6109b8c171f0 Mon Sep 17 00:00:00 2001
From: Bryan Joshua Pedini <bryan@pedini.dev>
Date: Fri, 17 Jul 2026 10:58:55 +0200
Subject: [PATCH] added permanent redirect from http to https in traefik itself
 instead of single each routers' rules

---
 docker-compose.yml | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index dfb6172..7af2839 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,10 +13,13 @@ services:
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.provider=${TRAEFIK_DNSPROVIDER}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.resolvers=${TRAEFIK_DNSRESOLVERS}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.email=${LETSENCRYPT_EMAIL}
-      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=RSA4096
+      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=EC384
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.storage=/certs.json
-      # we listen on both HTTP and HTTPS
+      # we listen on both HTTP and HTTPS and redirect
       - --entrypoints.http.address=:80
+      - --entrypoints.http.http.redirections.entrypoint.to=https
+      - --entrypoints.http.http.redirections.entrypoint.scheme=https
+      - --entrypoints.http.http.redirections.entrypoint.permanent=true
       - --entrypoints.https.address=:443
       # logging level
       - --log.level=${TRAEFIK_LOGLEVEL}
@@ -43,21 +46,15 @@ services:
       - traefik.http.middlewares.hsts.headers.stsSeconds=${TRAEFIK_STS_SECONDS}
       - traefik.http.middlewares.hsts.headers.stsIncludeSubdomains=${TRAEFIK_STS_SUBDOMAINS}
       - traefik.http.middlewares.hsts.headers.stsPreload=${TRAEFIK_STS_PRELOAD}
-      ### Section HTTP
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
-      # redirect Træfik dashboard to HTTPS only
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTP_MIDDLEWARES}
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.service=api@internal
-      ### Section HTTPS
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
+      # HTTPS
+      - traefik.http.routers.${TRAEFIK_ROUTER}.entrypoints=https
       # configure Træfik dashboard to be the exposed service
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.service=api@internal
+      - traefik.http.routers.${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.service=api@internal
       # of course, enable TLS and it's certificate provider
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
-      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
+      - traefik.http.routers.${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
     networks:
       - traefik
     ports: