chore: audit and fix service configurations and allowedOrigins

_tmp_coolify-noredirect.yaml

@@ -0,0 +1,20 @@
+# Override file added by us (homelab-configs).
+# Coolify auto-generates /data/coolify/proxy/dynamic/coolify.yaml with a
+# redirect-to-https middleware on the HTTP router. That redirect causes a
+# loop with our upstream alpine-caddy (LXC 101) which already terminates TLS.
+# This higher-priority router wins for the UI but explicitly excludes the
+# WebSocket paths so they keep using Coolify's own routers (coolify-realtime-ws
+# for /app, coolify-terminal-ws for /terminal/ws).
+http:
+  routers:
+    coolify-http-noredirect:
+      entryPoints:
+        - http
+      service: coolify-noredirect-svc
+      rule: 'Host(`coolify.klhoud.com`) && !PathPrefix(`/app`) && !PathPrefix(`/terminal/ws`)'
+      priority: 1000
+  services:
+    coolify-noredirect-svc:
+      loadBalancer:
+        servers:
+          - url: 'http://coolify:8080'