Swap certificates for wildcards

ansible/roles/pages/files/docker-compose.yml

@@ -12,7 +12,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.pages.rule=Host(`pages.theorangeone.net`)
-      - traefik.http.routers.pages.tls.certresolver=le
 
   traefik-pages:
     image: ghcr.io/realorangeone/traefik-pages:latest

ansible/roles/plausible/files/docker-compose.yml

@@ -12,10 +12,8 @@ services:
       - traefik.enable=true
       - traefik.http.routers.plausible.rule=Host(`plausible.theorangeone.net`)
       - traefik.http.services.plausible-plausible.loadbalancer.server.port=8000  # https://github.com/plausible/analytics/pull/237
-      - traefik.http.routers.plausible.tls.certresolver=le
 
       - traefik.http.routers.plausible-bare.rule=Host(`elbisualp.theorangeone.net`)
-      - traefik.http.routers.plausible-bare.tls.certresolver=le
       - traefik.http.routers.plausible-bare.service=plausible-plausible
 
       # https://github.com/plausible/analytics/pull/340

ansible/roles/privatebin/files/docker-compose.yml

@@ -12,4 +12,3 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.privatebin.rule=Host(`bin.theorangeone.net`)
-      - traefik.http.routers.privatebin.tls.certresolver=le

ansible/roles/pve_docker/files/calibre/docker-compose.yml

@@ -13,4 +13,3 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.calibre.rule=Host(`calibre.jakehoward.tech`)
-      - traefik.http.routers.calibre.tls.certresolver=le

ansible/roles/pve_docker/files/librespeed/docker-compose.yml

@@ -12,6 +12,5 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.librespeed.rule=Host(`speed.jakehoward.tech`)
-      - traefik.http.routers.librespeed.tls.certresolver=le
       - traefik.http.routers.librespeed.middlewares=librespeed-auth@docker
       - traefik.http.middlewares.librespeed-auth.basicauth.users={{ librespeed_basicauth }}

ansible/roles/pve_docker/files/nextcloud/docker-compose.yml

@@ -22,7 +22,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.nextcloud.rule=Host(`intersect.jakehoward.tech`)
-      - traefik.http.routers.nextcloud.tls.certresolver=le
       - traefik.http.services.nextcloud-nextcloud.loadbalancer.server.port=443
       - traefik.http.services.nextcloud-nextcloud.loadbalancer.server.scheme=https
       - traefik.http.middlewares.nextcloud-hsts.headers.stsseconds=15552000

ansible/roles/pve_docker/files/synapse/docker-compose.yml

@@ -18,7 +18,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.synapse.rule=Host(`matrix.jakehoward.tech`)
-      - traefik.http.routers.synapse.tls.certresolver=le
 
   db:
     image: postgres:12-alpine
@@ -42,6 +41,5 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.synapse-admin.rule=Host(`matrix.jakehoward.tech`) && PathPrefix(`/admin`)
-      - traefik.http.routers.synapse-admin.tls.certresolver=le
       - traefik.http.middlewares.synapse-admin-path.stripprefix.prefixes=/admin
       - traefik.http.routers.synapse-admin.middlewares=synapse-admin-path@docker

ansible/roles/pve_docker/files/tt-rss/docker-compose.yml

@@ -23,7 +23,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.tt-rss.rule=Host(`tt-rss.jakehoward.tech`)
-      - traefik.http.routers.tt-rss.tls.certresolver=le
     depends_on:
       - db
     tmpfs:

ansible/roles/pve_docker/files/wallabag/docker-compose.yml

@@ -13,7 +13,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.wallabag.rule=Host(`wallabag.jakehoward.tech`)
-      - traefik.http.routers.wallabag.tls.certresolver=le
     depends_on:
       - redis
 

ansible/roles/pve_docker/files/whoami/docker-compose.yml

@@ -7,4 +7,3 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`who.0rng.one`)
-      - traefik.http.routers.whoami.tls.certresolver=le

ansible/roles/traefik/files/file-provider-gitlab.yml

@@ -3,8 +3,6 @@ http:
     router-gitlab:
       rule: Host(`git.theorangeone.net`)
       service: service-gitlab
-      tls:
-        certResolver: le
   services:
     service-gitlab:
       loadBalancer:

ansible/roles/traefik/files/file-provider-grafana.yml

@@ -3,8 +3,6 @@ http:
     router-grafana:
       rule: Host(`grafana.jakehoward.tech`)
       service: service-grafana
-      tls:
-        certResolver: le
   services:
     service-grafana:
       loadBalancer:

ansible/roles/traefik/files/file-provider-homeassistant.yml

@@ -3,8 +3,6 @@ http:
     router-homeassistant:
       rule: Host(`homeassistant.jakehoward.tech`)
       service: service-homeassistant
-      tls:
-        certResolver: le
   services:
     service-homeassistant:
       loadBalancer:

ansible/roles/traefik/files/file-provider-jellyfin.yml

@@ -3,8 +3,6 @@ http:
     router-jellyfin:
       rule: Host(`media.jakehoward.tech`)
       service: service-jellyfin
-      tls:
-        certResolver: le
   services:
     service-jellyfin:
       loadBalancer:

ansible/roles/traefik/files/traefik.yml

@@ -17,6 +17,15 @@ entryPoints:
       middlewares:
         - floc-block@file
         - compress@file
+      tls:
+        certresolver: le
+        domains:
+          - main: theorangeone.net
+            sans: "*.theorangeone.net"
+          - main: jakehoward.tech
+            sans: "*.jakehoward.tech"
+          - main: 0rng.one
+            sans: "*.0rng.one"
     proxyProtocol:
       trustedIPs:
         - "{{ wireguard.cidr }}"

ansible/roles/upload/files/docker-compose.yml

@@ -12,7 +12,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.upload.rule=Host(`upload.theorangeone.net`)
-      - traefik.http.routers.upload.tls.certresolver=le
 
   img:
     image: ghcr.io/realorangeone/static-server:latest
@@ -24,7 +23,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.img.rule=Host(`img.theorangeone.net`) || Host(`img.0rng.one`)
-      - traefik.http.routers.img.tls.certresolver=le
 
   bg:
     image: ghcr.io/realorangeone/static-server:latest
@@ -37,7 +35,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.bg.rule=Host(`bg.theorangeone.net`)
-      - traefik.http.routers.bg.tls.certresolver=le
 
   dl:
     image: ghcr.io/realorangeone/static-server:latest
@@ -49,4 +46,3 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.dl.rule=Host(`dl.theorangeone.net`) || Host(`dl.0rng.one`)
-      - traefik.http.routers.dl.tls.certresolver=le

ansible/roles/uptime_kuma/files/docker-compose.yml

@@ -13,4 +13,3 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.uptime-kuma.rule=Host(`status.theorangeone.net`)
-      - traefik.http.routers.uptime-kuma.tls.certresolver=le

ansible/roles/vaultwarden/files/docker-compose.yml

@@ -16,12 +16,10 @@ services:
       - traefik.http.routers.vaultwarden-ui.rule=Host(`bw.jakehoward.tech`) || Host(`vaultwarden.jakehoward.tech`)
       - traefik.http.routers.vaultwarden-ui.service=vaultwarden-ui
       - traefik.http.services.vaultwarden-ui.loadbalancer.server.port=80
-      - traefik.http.routers.vaultwarden-ui.tls.certresolver=le
 
       - traefik.http.routers.vaultwarden-websocket.rule=(Host(`bw.jakehoward.tech`) || Host(`vaultwarden.jakehoward.tech`) )&& Path(`/notifications/hub`)
       - traefik.http.routers.vaultwarden-websocket.service=vaultwarden-websocket
       - traefik.http.services.vaultwarden-websocket.loadbalancer.server.port=3012
-      - traefik.http.routers.vaultwarden-websocket.tls.certresolver=le
 
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.average=5
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.burst=1000

ansible/roles/yourls/files/docker-compose.yml

@@ -18,7 +18,6 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.yourls.rule=Host(`0rng.one`)
-      - traefik.http.routers.yourls.tls.certresolver=le
 
   mariadb:
     image: mariadb:10.5