feat: keep local Traefik config in untracked traefik/dynamic.d

CHANGELOG.md

@@ -6,6 +6,11 @@ Changelog", this file is a reverse-chronological list of merged pull requests.
 
 ## Open PR's
 
+- [PR-157](https://github.com/itk-dev/devops_itkdev-docker/pull/157) - 2026-10-15 -
+  Traefik reads local dynamic config, such as Agent Proxy services and their
+  API keys, from the untracked `traefik/dynamic.d/`, so it can no longer be
+  committed with the shared `traefik/dynamic-conf.yaml`. Move services you
+  added to `dynamic-conf.yaml` into `dynamic.d/`, and run `traefik:start`
 - [PR-155](https://github.com/itk-dev/devops_itkdev-docker/pull/155) - 2026-10-05 -
   Python template: select the services to lint and test by the label
   `dk.itkdev.language: python` instead of `dk.itkdev.python: "true"`

traefik/docker-compose.yml

@@ -34,6 +34,8 @@ services:
       - "443:443"
     volumes:
       - $PWD/traefik.yml:/traefik.yml:ro
+      # Untracked local config (e.g. Agent Proxy services) is /config; the shared file is mounted into it.
+      - $PWD/dynamic.d:/config:ro
       - $PWD/dynamic-conf.yaml:/config/dynamic-conf.yaml:ro
       - $PWD/ssl:/certs:ro
     labels:

traefik/dynamic.d/.gitignore

@@ -0,0 +1,6 @@
+# Local Traefik dynamic configuration, e.g. services written by Agent Proxy.
+# Files here can hold API keys, so nothing in this directory is committed
+# except this file and the mount point for ../dynamic-conf.yaml.
+*
+!.gitignore
+!dynamic-conf.yaml

traefik/dynamic.d/dynamic-conf.yaml

@@ -0,0 +1,3 @@
+# Mount point only. Inside the Traefik container ../dynamic-conf.yaml is
+# mounted over this file, so edits here have no effect. Edit
+# traefik/dynamic-conf.yaml for shared configuration instead.