feat: restore traefik to prod compose and add standalone traefik compose

- Add Traefik v3.2 service back to docker-compose.prod.yml with: - Dashboard with basic auth middleware - Let's Encrypt TLS challenge - HTTP→HTTPS redirect - Health checks and structured logging - Create docker-compose.traefik.yml for standalone Traefik deployment: - Mirrors production Traefik configuration - Isolated network for external proxy usage - Persistent certificate storage - Add TRAEFIK_ACME_EMAIL to .env.example - All compose files validated with docker compose config
2026-05-16 12:37:03 +00:00
parent 8136eae8f4
commit 2655a29886
3 changed files with 97 additions and 1 deletions
@@ -0,0 +1,51 @@
+services:
+  traefik:
+    image: traefik:v3.2
+    container_name: traefik
+    command:
+      - --api.dashboard=true
+      - --api.insecure=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=${TRAEFIK_NETWORK:-traefik}
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
+      - --accesslog=true
+      - --ping=true
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik-certs:/letsencrypt
+    networks:
+      - traefik
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
+      - traefik.http.routers.traefik-dashboard.service=api@internal
+      - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth@file
+      - traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/ping || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
+volumes:
+  traefik-certs:
+
+networks:
+  traefik:
+    name: ${TRAEFIK_NETWORK:-traefik}
+    driver: bridge