From 2655a2988631a1b63bf9b1f42bed6ffcf7322164 Mon Sep 17 00:00:00 2001
From: Alex Blank <alexblank@fastmail.com>
Date: Sat, 16 May 2026 12:37:03 +0000
Subject: [PATCH] feat: restore traefik to prod compose and add standalone
 traefik compose
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add Traefik v3.2 service back to docker-compose.prod.yml with:
  - Dashboard with basic auth middleware
  - Let's Encrypt TLS challenge
  - HTTP→HTTPS redirect
  - Health checks and structured logging
- Create docker-compose.traefik.yml for standalone Traefik deployment:
  - Mirrors production Traefik configuration
  - Isolated network for external proxy usage
  - Persistent certificate storage
- Add TRAEFIK_ACME_EMAIL to .env.example
- All compose files validated with docker compose config
---
 .env.example               |  1 +
 docker-compose.prod.yml    | 46 +++++++++++++++++++++++++++++++++-
 docker-compose.traefik.yml | 51 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 97 insertions(+), 1 deletion(-)
 create mode 100644 docker-compose.traefik.yml

diff --git a/.env.example b/.env.example
index 315f14c..a86dbe8 100644
--- a/.env.example
+++ b/.env.example
@@ -26,6 +26,7 @@ TRAEFIK_NETWORK=traefik
 TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
 TRAEFIK_LOG_LEVEL=INFO
+TRAEFIK_ACME_EMAIL=admin@example.com
 TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
 
 # Frontend build-time variables (passed to web container)
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ddbcd42..4d21aa6 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -77,13 +77,57 @@ services:
       retries: 5
     restart: unless-stopped
 
+  traefik:
+    image: traefik:v3.2
+    command:
+      - --api.dashboard=true
+      - --api.insecure=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=${TRAEFIK_NETWORK:-traefik}
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
+      - --accesslog=true
+      - --ping=true
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik-certs:/letsencrypt
+    networks:
+      - platform
+      - traefik
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
+      - traefik.http.routers.traefik-dashboard.service=api@internal
+      - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth@file
+      - traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/ping || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
 volumes:
   postgres-data:
   api-data:
+  traefik-certs:
 
 networks:
   platform:
     driver: bridge
   traefik:
     name: ${TRAEFIK_NETWORK:-traefik}
-    external: true
+    driver: bridge
diff --git a/docker-compose.traefik.yml b/docker-compose.traefik.yml
new file mode 100644
index 0000000..ab853f0
--- /dev/null
+++ b/docker-compose.traefik.yml
@@ -0,0 +1,51 @@
+services:
+  traefik:
+    image: traefik:v3.2
+    container_name: traefik
+    command:
+      - --api.dashboard=true
+      - --api.insecure=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=${TRAEFIK_NETWORK:-traefik}
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
+      - --accesslog=true
+      - --ping=true
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik-certs:/letsencrypt
+    networks:
+      - traefik
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
+      - traefik.http.routers.traefik-dashboard.service=api@internal
+      - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth@file
+      - traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/ping || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
+volumes:
+  traefik-certs:
+
+networks:
+  traefik:
+    name: ${TRAEFIK_NETWORK:-traefik}
+    driver: bridge