From 41d93563d0a61635bec8a3dac0c847ab89b30326 Mon Sep 17 00:00:00 2001
From: Luke Else <mail@luke-else.co.uk>
Date: Fri, 10 Jul 2026 22:24:58 +0100
Subject: [PATCH] chore: Removed password auth from traefik as not needed

---
 readme.md                                | 3 +--
 services/dev/traefik-docker-compose.yml  | 6 ++----
 services/prod/traefik-docker-compose.yml | 2 --
 services/vpn/traefik-docker-compose.yml  | 6 ++----
 4 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/readme.md b/readme.md
index 72f2796..4e1883d 100644
--- a/readme.md
+++ b/readme.md
@@ -205,7 +205,7 @@ Every public-facing service is fronted by its host's own Traefik instance, termi
 |---|---|---|
 | Traefik | `traefik-docker-compose.yml` | `traefik.cicd.luke-else.co.uk` |
 | Gitea | `gitea-docker-compose.yml` | `git.luke-else.co.uk` (HTTP), SSH on `222` |
-| Gitea Actions runner(s) | `Runners/docker-compose.yml` (generated — see [Scaling Gitea Actions runners](#scaling-gitea-actions-runners)) | `cicd.luke-else.co.uk` |
+| Gitea Actions runner(s) | `Runners/docker-compose.yml` (generated — see [Scaling Gitea Actions runners](#scaling-gitea-actions-runners)) | N/A |
 | Watchtower | `watchtower-docker-compose.yml` | — |
 
 ### `prod`
@@ -231,7 +231,6 @@ Every public-facing service is fronted by its host's own Traefik instance, termi
 
 A few things need manual attention before a stack is fully live — tracked in [`services/todo.md`](services/todo.md), summarized here:
 
-- **Traefik dashboard auth**: the committed basic-auth hash is a placeholder. Generate your own with `echo $(htpasswd -nb user password) | sed -e 's/\$/\$\$/g'` and replace the `traefik-auth` middleware value in each `traefik-docker-compose.yml`.
 - **General host hardening**: non-root user, Docker, and unattended-upgrades are now handled automatically by the [post-install bootstrap](#post-install-bootstrap); UFW is the remaining manual item in `services/todo.md` (the Hetzner Cloud Firewalls already allowlist per-host ports — see [Security notes](#security-notes)).
 
 ## Development container
diff --git a/services/dev/traefik-docker-compose.yml b/services/dev/traefik-docker-compose.yml
index e8970fd..41f308c 100644
--- a/services/dev/traefik-docker-compose.yml
+++ b/services/dev/traefik-docker-compose.yml
@@ -30,11 +30,9 @@ services:
       - "traefik.http.routers.traefik.rule=Host(`traefik.cicd.luke-else.co.uk`)"
       - "traefik.http.routers.traefik.entrypoints=websecure"
       - "traefik.http.routers.traefik.service=api@internal"
-      - "traefik.http.routers.traefik.tls.certresolver=myresolver" 
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=user:$$2y$$05$$s/vPphFtSO2fWJR7SYkEb.90UwPDRM3aOKqgOF/rme/3fUQ5tvpTS"
+      - "traefik.http.routers.traefik.tls.certresolver=myresolver"
     restart: unless-stopped
 
 networks:
   proxy:
-    name: proxy
\ No newline at end of file
+    name: proxy
diff --git a/services/prod/traefik-docker-compose.yml b/services/prod/traefik-docker-compose.yml
index 53e89ac..109a7eb 100644
--- a/services/prod/traefik-docker-compose.yml
+++ b/services/prod/traefik-docker-compose.yml
@@ -36,8 +36,6 @@ services:
       - "traefik.http.routers.traefik.entrypoints=websecure"
       - "traefik.http.routers.traefik.service=api@internal"
       - "traefik.http.routers.traefik.tls.certresolver=myresolver"
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=user:$$2y$$05$$s/vPphFtSO2fWJR7SYkEb.90UwPDRM3aOKqgOF/rme/3fUQ5tvpTS"
     restart: unless-stopped
 
 networks:
diff --git a/services/vpn/traefik-docker-compose.yml b/services/vpn/traefik-docker-compose.yml
index 7383006..50a0f18 100644
--- a/services/vpn/traefik-docker-compose.yml
+++ b/services/vpn/traefik-docker-compose.yml
@@ -30,11 +30,9 @@ services:
       - "traefik.http.routers.traefik.rule=Host(`traefik.vpn.luke-else.co.uk`)"
       - "traefik.http.routers.traefik.entrypoints=websecure"
       - "traefik.http.routers.traefik.service=api@internal"
-      - "traefik.http.routers.traefik.tls.certresolver=myresolver" 
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=user:$$2y$$05$$s/vPphFtSO2fWJR7SYkEb.90UwPDRM3aOKqgOF/rme/3fUQ5tvpTS"
+      - "traefik.http.routers.traefik.tls.certresolver=myresolver"
     restart: unless-stopped
 
 networks:
   proxy:
-    name: proxy
\ No newline at end of file
+    name: proxy