All SpaceMusic subdomains and their routing configuration.

DNS¶

All A records point to a single IP: 136.243.124.138. There is no load balancer -- Traefik handles all routing on the server itself.

Subdomain Map¶

Traefik Routing¶

Traefik is the reverse proxy handling all HTTPS routing and TLS certificates. It uses file-based dynamic configuration stored at /var/lib/devpush/traefik/ on the server.

Each service has its own Traefik config file (e.g., authentik.yml, storage.yml, relay.yml) that defines:

• A router matching the hostname
• A service pointing to the container's internal port
• TLS via Let's Encrypt (certResolver: le)
• Optional middleware (e.g., authentik@file for forward auth)

Example Traefik config structure:

http:
  routers:
    my-service:
      rule: "Host(`my-service.spacemusic.tv`)"
      entrypoints:
        - websecure
      service: my-service
      tls:
        certResolver: le
      middlewares:
        - authentik@file
  services:
    my-service:
      loadBalancer:
        servers:
          - url: "http://container-name:8000"

devpush-managed services get their Traefik config generated automatically by devpush. The devpush-auth-patch.sh systemd watcher then injects the authentik@file middleware into those generated configs after every deploy.

Adding a New Subdomain¶

1. Create a DNS A record pointing to 136.243.124.138
2. Create a Traefik config file at /var/lib/devpush/traefik/<service>.yml
3. If the service needs SSO, add authentik@file middleware and create a Proxy Provider in Authentik
4. Traefik will automatically detect the new config file and request a Let's Encrypt certificate