fix traefik template: use splitList instead of split

Sprig split() returns map[string]string, and ranging over it outputs
map keys into the YAML, corrupting the rendered config. splitList()
returns []string which ranges correctly. Also removed unused
rate-limit middleware.

traefik/dynamic/services.yml

@@ -1,51 +1,29 @@
-{{/* ═══════════════════════════════════════════════════════════════
-     REEF — the single source of truth for all routing.
-     To add a service: add one entry to $reef below.
-     FQDN pattern: {name}.{DOMAIN}  (DOMAIN from env, e.g. homelab.fhirworx.io)
-
-     Adding a service to the reef:
-     1. compose.yml  — add service block
-     2. Here         — add 1 line to $reef dict
-     3. prometheus/targets/services.yml — add 4 lines (if metrics)
-     4. nginx/index.html — add tile with data-subdomain (optional)
-     ═══════════════════════════════════════════════════════════════ */}}
-
 {{- $domain := env "DOMAIN" | default "homelab.fhirworx.io" -}}
-
-{{/* ── The Reef: one router + one backend per service ───────────── */}}
 {{- $reef := dict
-  "dashboard"   (dict "port" "80"    "theme" true  "extra_hosts" (list $domain) "mw" "secure-headers")
+  "dashboard"          (dict "port" "80"    "theme" true  "extra_hosts" (list $domain) "mw" "secure-headers")
-  "gitea"       (dict "port" "3000"  "theme" true  "mw" "secure-headers,rate-limit")
+  "gitea"              (dict "port" "3000"  "theme" true  "mw" "secure-headers")
-  "woodpecker-server" (dict "port" "8000" "theme" true "subdomain" "ci" "mw" "local-only,secure-headers,rate-limit")
+  "woodpecker-server"  (dict "port" "8000"  "theme" true  "subdomain" "ci" "mw" "local-only,secure-headers")
-  "notebooks"   (dict "port" "2718"  "theme" true  "mw" "local-only,secure-headers")
+  "notebooks"          (dict "port" "2718"  "theme" true  "mw" "local-only,secure-headers")
-  "zotero"      (dict "port" "8080"  "theme" true  "mw" "secure-headers")
+  "zotero"             (dict "port" "8080"  "theme" true  "mw" "secure-headers")
-  "nessie"      (dict "port" "19120" "theme" false "mw" "local-only,infra-headers")
+  "nessie"             (dict "port" "19120" "theme" false "mw" "local-only,infra-headers")
-  "trino"       (dict "port" "8080"  "theme" true  "mw" "local-only,infra-headers")
+  "trino"              (dict "port" "8080"  "theme" true  "mw" "local-only,infra-headers")
-  "polaris"     (dict "port" "8181"  "theme" false "mw" "local-only,infra-headers")
+  "polaris"            (dict "port" "8181"  "theme" false "mw" "local-only,infra-headers")
-  "grafana"     (dict "port" "3000"  "theme" true  "mw" "local-only,secure-headers")
+  "grafana"            (dict "port" "3000"  "theme" true  "mw" "local-only,secure-headers")
-  "prometheus"  (dict "port" "9090"  "theme" true  "mw" "local-only,infra-headers")
+  "prometheus"         (dict "port" "9090"  "theme" true  "mw" "local-only,infra-headers")
-  "jaeger"      (dict "port" "16686" "theme" true  "mw" "local-only,infra-headers")
+  "jaeger"             (dict "port" "16686" "theme" true  "mw" "local-only,infra-headers")
-  "loki"        (dict "port" "3100"  "theme" false "mw" "local-only,infra-headers")
+  "loki"               (dict "port" "3100"  "theme" false "mw" "local-only,infra-headers")
 -}}
-
-{{/* ── Multi-endpoint services ─────────────────────────────────── */}}
 {{- $multi := dict
-  "rustfs-api"     (dict "container" "rustfs" "port" "9000" "subdomain" "s3"    "theme" false "mw" "local-only,infra-headers")
+  "rustfs-api"         (dict "container" "rustfs" "port" "9000" "subdomain" "s3"        "theme" false "mw" "local-only,infra-headers")
-  "rustfs-console" (dict "container" "rustfs" "port" "9001" "subdomain" "s3console" "theme" true  "mw" "local-only,infra-headers")
+  "rustfs-console"     (dict "container" "rustfs" "port" "9001" "subdomain" "s3console" "theme" true  "mw" "local-only,infra-headers")
 -}}
-
 http:
-  {{/* ── Middlewares (inlined — no separate middlewares.yml) ──────── */}}
   middlewares:
     secure-headers:
       headers:
         frameDeny: true
         browserXssFilter: true
         contentTypeNosniff: true
-    rate-limit:
-      rateLimit:
-        average: 100
-        burst: 50
     local-only:
       ipAllowList:
         sourceRange:
@@ -68,8 +46,6 @@ http:
           rewrites:
             - regex: "</head>"
               replacement: '<link rel="icon" type="image/svg+xml" href="http://{{ $domain }}/favicon.svg"><link rel="stylesheet" type="text/css" href="http://{{ $domain }}/throwback.css"></head>'
-
-  {{/* ── Generated routers ─────────────────────────────────────── */}}
   routers:
     {{- range $name, $svc := $reef }}
     {{ $name }}:
@@ -80,7 +56,7 @@ http:
       {{- $mwList := list -}}
       {{- if get $svc "theme" }}{{ $mwList = append $mwList "inject-throwback" }}{{ end -}}
       {{- $extra := get $svc "mw" | default "" -}}
-      {{- if ne $extra "" }}{{ range split "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
+      {{- if ne $extra "" }}{{ range splitList "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
       {{- if $mwList }}
       middlewares:
         {{- range $mwList }}
@@ -97,7 +73,7 @@ http:
       {{- $mwList := list -}}
       {{- if get $svc "theme" }}{{ $mwList = append $mwList "inject-throwback" }}{{ end -}}
       {{- $extra := get $svc "mw" | default "" -}}
-      {{- if ne $extra "" }}{{ range split "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
+      {{- if ne $extra "" }}{{ range splitList "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
       {{- if $mwList }}
       middlewares:
         {{- range $mwList }}
@@ -114,8 +90,6 @@ http:
         - inject-throwback
         - local-only
         - infra-headers
-
-  {{/* ── Generated services ────────────────────────────────────── */}}
   services:
     {{- range $name, $svc := $reef }}
     {{ $name }}: