Want to replace a Traefik docker site with a redirect; can't get it working

Traefik Traefik v2
, ,
14

Thanks -- tried without $$ and removed permanent: true (good point). Same error.
I think the actual 308 is coming from my http-to-https redirect here, now commented out:

entryPoints:
  web:
    address: ":80"
    # http:
    #   redirections:
    #     entryPoint:
    #       to: websecure
  websecure:
    address: ":443"
    http:
      tls: {}

because with that commented out, I just get a 404 when I curl (curl should avoid any caches). So my middleware isn't actually getting triggered, looks like.
The log only says this:

reverse-proxy    | 127.0.0.1 - - [24/Jul/2024:14:58:27 +0000] "HEAD /thing1/thing2 HTTP/1.1" 404 19 "-" "-" 2 "-" "-" 0ms
reverse-proxy    | 172.18.0.1 - - [24/Jul/2024:14:58:27 +0000] "HEAD /thing1/thing2 HTTP/2.0" 404 0 "-" "-" 1 "websecure-oberbrunnerdotcom@file" "http://127.0.0.1" 1ms

the 127.0.0.1 is presumably from the dummy service I had to add to the router, even though the redirect should catch everything. Looks like the middleware isn't triggering, and the dummy service serves a 404.
(Note: I'm running Traefik 2.11 now.)

EDIT: aha -- using ^https?://oberbrunner.com as the regex (i.e. adding optional "s") makes it work. So I guess the regex is applied to the URL before TLS termination.
Whew -- thanks for sticking with me til I got it working!