From 3697ddd5c59c5762dd5957ae3ded169dee51cc52 Mon Sep 17 00:00:00 2001
From: harkon <harris@harkon.co.uk>
Date: Mon, 1 Dec 2025 21:39:36 +0200
Subject: [PATCH] fix: add traefik constraint label to infrastructure services

---
 infra/base/infrastructure.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/infra/base/infrastructure.yaml b/infra/base/infrastructure.yaml
index 5a4a790..d2dfa23 100644
--- a/infra/base/infrastructure.yaml
+++ b/infra/base/infrastructure.yaml
@@ -106,6 +106,7 @@ services:
       - apa-authentik-redis
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.authentik.rule=Host(`auth.${DOMAIN}`)"
       - "traefik.http.routers.authentik.entrypoints=websecure"
       - "traefik.http.routers.authentik.tls=true"
@@ -174,6 +175,7 @@ services:
       - "traefik.local.lan:host-gateway"
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN}`)"
       - "traefik.http.routers.vault.entrypoints=websecure"
       - "traefik.http.routers.vault.tls=true"
@@ -213,6 +215,7 @@ services:
       - "traefik.local.lan:host-gateway"
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.minio-api.rule=Host(`minio-api.${DOMAIN}`)"
       - "traefik.http.routers.minio-api.entrypoints=websecure"
       - "traefik.http.routers.minio-api.tls=true"
@@ -242,6 +245,7 @@ services:
       QDRANT__LOG_LEVEL: INFO
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.qdrant.rule=Host(`qdrant.${DOMAIN}`)"
       - "traefik.http.routers.qdrant.entrypoints=websecure"
       - "traefik.http.routers.qdrant.tls=true"
@@ -270,6 +274,7 @@ services:
       NEO4J_apoc_import_file_use__neo4j__config: true
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.neo4j.rule=Host(`neo4j.${DOMAIN}`)"
       - "traefik.http.routers.neo4j.entrypoints=websecure"
       - "traefik.http.routers.neo4j.tls=true"
@@ -364,6 +369,7 @@ services:
       retries: 3
     labels:
       - "traefik.enable=true"
+      - "traefik.constraint-label=app"
       - "traefik.http.routers.nats-monitor.rule=Host(`nats.${DOMAIN}`)"
       - "traefik.http.routers.nats-monitor.entrypoints=websecure"
       - "traefik.http.routers.nats-monitor.tls=true"