From 1c862d0bd740ed23c6328b7877c87cc0c5386976 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Sat, 21 Mar 2026 01:28:01 +0300
Subject: [PATCH] https for traefik

---
 traefik-values.yaml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/traefik-values.yaml b/traefik-values.yaml
index cdfa97a..d01c363 100644
--- a/traefik-values.yaml
+++ b/traefik-values.yaml
@@ -7,7 +7,28 @@ providers:
 additionalArguments:
   - "--certificatesresolvers.letsencrypt.acme.email=certs@asxp.io"
   - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
-  - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+  - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+
+podSecurityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  fsGroup: 65532
+  fsGroupChangePolicy: "OnRootMismatch"
+
+deployment:
+  additionalContainers: []
+  initContainers:
+    - name: volume-permissions
+      image: busybox:latest
+      command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+      volumeMounts:
+        - name: data
+          mountPath: /data
 
 persistence:
   enabled: true