Skip to main content
All LibOps application stacks use Traefik for ingress. The sitectl traefik namespace is now intentionally small: it exposes service-level inspection, while ingress configuration is owned by the app plugin’s ingress component.

​
Status

Check the Traefik container:

​
Ingress Settings

Use sitectl set ingress ... for settings that alter Traefik and downstream application config. The command applies the file changes immediately:
The ingress component updates the Compose Traefik service and dynamic router files together with the application settings mapped by the active plugin. On PHP/nginx application services, --upload-timeout configures Traefik read timeouts, nginx client-body and FastCGI timeouts, and PHP input, execution, and FPM request-termination timeouts. PHP accepts whole seconds, so subsecond values are rounded up. For another application runtime, the Traefik limit still changes, but the setting is end to end only when that plugin also maps the runtime’s supported backend timeout and proxy controls. ArchivesSpace deliberately opts out of the shared PHP/nginx application environment while retaining generic Traefik ingress changes.

​
TLS Modes

Use --mode https for the self-hosted Cloudflare Origin CA mode. This configures Traefik for HTTPS with certificates mounted at certs/cert.pem and certs/privkey.pem; put a Cloudflare Origin CA certificate and private key at those paths before starting the stack. Managed LibOps domains use Google Certificate Manager and the LibOps Google Cloud edge; they do not use this self-hosted mode. Use --mode https-letsencrypt when the hostname resolves directly to the origin and is not proxied through Cloudflare during issuance. This mode requires --acme-email and stores ACME state in the acme-data Compose volume. Use --mode https-custom when you bring your own certificate pair. Drop the public certificate chain at certs/cert.pem and the private key at certs/privkey.pem. Traefik receives read-only mounts for those two leaf files, not the whole certs directory. Keep CA signing keys such as rootCA-key.pem in that directory only when another local tool needs them; ingress convergence removes legacy directory mounts so the signing key is not exposed to the Traefik container. Use --mode https-mkcert only for development-style contexts such as local, dev, test, qa, or sandbox. sitectl runs mkcert for the selected domain and writes the same certs/cert.pem and certs/privkey.pem files for Traefik.

​
Bot Mitigation

Bot mitigation remains a component where supported by the active app plugin:

​
Reference

Show the compose service container status