From 1db9dcec81e7212e792399ddee5d5109bf6f226f Mon Sep 17 00:00:00 2001
From: v1rusnl <18641204+v1rusnl@users.noreply.github.com>
Date: Fri, 3 Jul 2026 08:21:12 +0200
Subject: [PATCH 1/3] Update Traefik image version to v3.7

---
 install/config/docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/config/docker-compose.yml b/install/config/docker-compose.yml
index 96b15ce47..05b2fbe8c 100644
--- a/install/config/docker-compose.yml
+++ b/install/config/docker-compose.yml
@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

From ab199555023eac5a1d6cc196023e44ea76728796 Mon Sep 17 00:00:00 2001
From: v1rusnl <18641204+v1rusnl@users.noreply.github.com>
Date: Fri, 3 Jul 2026 08:22:13 +0200
Subject: [PATCH 2/3] Upgrade Traefik image to version 3.7

---
 compose.example.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.example.yaml b/compose.example.yaml
index 50cb1bcc1..5a35e20cf 100644
--- a/compose.example.yaml
+++ b/compose.example.yaml
@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

From bb5547a157bda0cbc806fc8233a309ff635d0930 Mon Sep 17 00:00:00 2001
From: Aditya kumar singh <143548997+Adityakk9031@users.noreply.github.com>
Date: Wed, 8 Jul 2026 23:33:57 +0530
Subject: [PATCH 3/3] fix: redirect to /auth/initial-setup after hitting auth
 rate limit (#3408)

---
 server/routers/external.ts |  7 ++++++-
 src/app/page.tsx           | 11 ++++++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/server/routers/external.ts b/server/routers/external.ts
index 8a22393ca..3151602aa 100644
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -1338,6 +1338,12 @@ authenticated.get("/ws/round-trip-message/:messageId", checkRoundTripMessage);
 // Auth routes
 export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);
+
+// Register setup-check BEFORE the global auth rate limiter.
+// This endpoint is called on every dashboard root page load (pure boolean
+// read, no secrets) and must not consume the auth rate-limit budget.
+authRouter.get("/initial-setup-complete", auth.initialSetupComplete);
+
 authRouter.use(
     rateLimit({
         windowMs:
@@ -1642,7 +1648,6 @@ authRouter.post("/idp/:idpId/oidc/generate-url", idp.generateOidcUrl);
 authRouter.post("/idp/:idpId/oidc/validate-callback", idp.validateOidcCallback);
 
 authRouter.put("/set-server-admin", auth.setServerAdmin);
-authRouter.get("/initial-setup-complete", auth.initialSetupComplete);
 authRouter.post("/validate-setup-token", auth.validateSetupToken);
 
 // Security Key routes
diff --git a/src/app/page.tsx b/src/app/page.tsx
index 7f0f05b57..c07475eb5 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -30,14 +30,19 @@ export default async function Page(props: {
     const getUser = cache(verifySession);
     const user = await getUser({ skipCheckVerifyEmail: true });
 
-    let complete = false;
+    let complete: boolean | null = null; // null means "unknown" (request errored)
     try {
         const setupRes = await internal.get<
             AxiosResponse<InitialSetupCompleteResponse>
         >(`/auth/initial-setup-complete`, await authCookieHeader());
         complete = setupRes.data.data.complete;
-    } catch (e) {}
-    if (!complete) {
+    } catch (e) {
+        // Swallow errors (e.g. 429 rate limit, 500, network failure).
+        // Only redirect to initial-setup when the server *confirms* setup
+        // is incomplete (complete === false). If the request itself failed we
+        // cannot tell, so fall through to the login redirect instead.
+    }
+    if (complete === false) {
         redirect("/auth/initial-setup");
     }