Answer domain redirects from the edge, with or without Traefik

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

traefik.go

@@ -244,6 +244,36 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, binds map[strin
 	}
 	for _, ms := range maps {
 		m := ms.m
+		if m.IsRedirect() { // answered by Traefik itself: no relay, login or target
+			rule, wildcard := hostRule(m.Hostname)
+			var eps []string
+			for _, ip := range t.bindsOf(m) {
+				eps = append(eps, epName(ip, m.Port))
+			}
+			prio := 5000
+			if wildcard {
+				prio = 2000
+			}
+			to := strings.ReplaceAll(m.RedirectTo, "$", "$$") // "$" would otherwise start a group reference
+			regex, repl := "^.*", to
+			if m.RedirectKeepPath {
+				regex, repl = "^https?://[^/]+(.*)", strings.TrimRight(to, "/")+"${1}"
+			}
+			mws["rd-"+m.ID] = map[string]any{"redirectRegex": map[string]any{"regex": regex, "replacement": repl, "permanent": m.RedirectPermanent}}
+			router := map[string]any{"rule": rule, "entryPoints": eps, "service": "noop@internal", "middlewares": []string{"rd-" + m.ID}, "priority": prio}
+			if m.Proto == model.ProtoHTTPS {
+				tlsCfg := map[string]any{}
+				if !t.cfg.NoACME {
+					tlsCfg["certResolver"] = "le"
+					if wildcard {
+						tlsCfg["domains"] = []map[string]any{{"main": m.Hostname}}
+					}
+				}
+				router["tls"] = tlsCfg
+			}
+			routers["m-"+m.ID] = router
+			continue
+		}
 		if ms.relayPort == 0 {
 			continue
 		}