api:
  dashboard: true
  insecure: true   # Dashboard on :8080 — restrict in production

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

providers:
  docker:
    exposedByDefault: false
  file:
    directory: /etc/traefik/dynamic
    watch: true

# Suppress encoded-character split-view warning (Ignition is RFC 3986 compliant)
core:
  defaultRuleSyntax: v3

log:
  level: INFO

ping: {}