fix(traefik): finite readTimeout on entrypoints to stop fd-leak unreachability

data/traefik.yml

@@ -1,13 +1,25 @@
 entryPoints:
   http:
     address: ":80"
+    # Finite read timeout so abandoned/slowloris connections (constant on a
+    # public IP from internet scanners) are reaped instead of holding a file
+    # descriptor forever. Without it traefik leaks fds until accept() fails with
+    # EMFILE and the shard goes unreachable. 300s stays generous for slow/large
+    # uploads; writeTimeout is left at its default (0) so large downloads, SSE,
+    # and long-poll responses are not cut off.
+    transport:
+      respondingTimeouts:
+        readTimeout: "300s"
     http:
       redirections:
         entryPoint:
           to: https
           scheme: https
   https:
     address: ":443"
+    transport:
+      respondingTimeouts:
+        readTimeout: "300s"
   mqtt:
     address: ":8883"
 

data/traefik_no_ssl.yml

@@ -1,6 +1,11 @@
 entryPoints:
   http:
     address: ":80"
+    # See traefik.yml: finite read timeout reaps abandoned/slowloris connections
+    # so traefik does not leak file descriptors until accept() hits EMFILE.
+    transport:
+      respondingTimeouts:
+        readTimeout: "300s"
   mqtt:
     address: ":8883"