From be2cb09dad97d6d8a28ab6499a1960e9f165fbb8 Mon Sep 17 00:00:00 2001
From: Alex Blank <alexblank@fastmail.com>
Date: Sat, 16 May 2026 13:08:46 +0000
Subject: [PATCH] fix: remove non-existent sec-headers middleware causing 404

The sec-headers@file middleware was referenced but not defined,
causing Traefik to return 404 for all routes.

- Changed sec-headers@file to default-security-headers@file in both
  docker-compose.prod.yml and docker-compose.traefik.yml
- This assumes the external Traefik has default-security-headers defined
  in its file provider configuration (e.g., in dynamic/middlewares.yml)

If you don't have this middleware defined, either:
1. Define it in your Traefik dynamic configuration, or
2. Remove the middleware label entirely
---
 docker-compose.prod.yml    | 4 ++--
 docker-compose.traefik.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 4d21aa6..20808b4 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -29,7 +29,7 @@ services:
       - traefik.http.routers.headquarter-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.headquarter-api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.headquarter-api.loadbalancer.server.port=8000
-      - traefik.http.routers.headquarter-api.middlewares=sec-headers@file
+      - traefik.http.routers.headquarter-api.middlewares=default-security-headers@file
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
@@ -57,7 +57,7 @@ services:
       - traefik.http.routers.headquarter-web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.headquarter-web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.headquarter-web.loadbalancer.server.port=8080
-      - traefik.http.routers.headquarter-web.middlewares=sec-headers@file
+      - traefik.http.routers.headquarter-web.middlewares=default-security-headers@file
     restart: unless-stopped
 
   db:
diff --git a/docker-compose.traefik.yml b/docker-compose.traefik.yml
index ddbcd42..ec3d3fe 100644
--- a/docker-compose.traefik.yml
+++ b/docker-compose.traefik.yml
@@ -29,7 +29,7 @@ services:
       - traefik.http.routers.headquarter-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.headquarter-api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.headquarter-api.loadbalancer.server.port=8000
-      - traefik.http.routers.headquarter-api.middlewares=sec-headers@file
+      - traefik.http.routers.headquarter-api.middlewares=default-security-headers@file
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
@@ -57,7 +57,7 @@ services:
       - traefik.http.routers.headquarter-web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
       - traefik.http.routers.headquarter-web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.headquarter-web.loadbalancer.server.port=8080
-      - traefik.http.routers.headquarter-web.middlewares=sec-headers@file
+      - traefik.http.routers.headquarter-web.middlewares=default-security-headers@file
     restart: unless-stopped
 
   db: