From 0c39732f63f132d69cca854e1555a8d366eea125 Mon Sep 17 00:00:00 2001
From: OdooSky v3 <m@havari.me>
Date: Tue, 5 May 2026 12:04:22 +0200
Subject: [PATCH] =?UTF-8?q?fix(traefik):=20platform-level=20HTTP=E2=86=92H?=
 =?UTF-8?q?TTPS=20redirect=20at=20the=20web=20entrypoint?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 values.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/values.yaml b/values.yaml
index b750519..f0dc2f5 100644
--- a/values.yaml
+++ b/values.yaml
@@ -115,6 +115,18 @@ traefik:
   enabled: true
   service:
     type: LoadBalancer
+  # Platform-level HTTP → HTTPS redirect. Without this, browsers that
+  # default to http:// on a bare hostname hit Traefik's `web`
+  # entrypoint with no matching IngressRoute and get the built-in
+  # "404 page not found". Enabling redirectTo at the entrypoint makes
+  # every TCP-80 request bounce to TCP-443 with a 301 — applies
+  # uniformly to all IngressRoutes on this cluster, no per-instance
+  # Middleware or duplicate IngressRoute needed.
+  ports:
+    web:
+      redirectTo:
+        port: websecure
+        priority: 10
 
 # secrets — Tower applies these out-of-band via the registered
 # kubeconfig at Connect time (B2). The chart references them by