feat: enhance deployment configuration for secure Web UI with Traefik integration

Added support for a secure Web UI using Traefik with Let's Encrypt and Cloudflare DNS challenge. Updated docker-compose files to include new service definitions and environment variables for configuration. Improved documentation to guide users in setting up the secure UI environment.

deploy/compose/stack.microvps-full.yaml

@@ -3,6 +3,9 @@
 # с встроенными configs для Prometheus (как у вас).
 #
 # Postgres: shm_size + start_period — иначе часто «dependency postgres failed» на слабом хосте.
+# Для защищенного Web UI задайте переменные окружения перед запуском:
+#   WEBUI_DOMAIN, WEBUI_IP_WHITELIST, LETSENCRYPT_EMAIL, CF_DNS_API_TOKEN
+# Cloudflare запись для WEBUI_DOMAIN: DNS only (серый облачок).
 name: evobgp-microvps-full
 
 configs:
@@ -58,7 +61,7 @@ services:
         max-file: "3"
 
   bird2:
-    image: git.shts.su/denozord/evobgp-bird2:latest
+    image: ${EVOBGP_REGISTRY:-git.shts.su/denozord}/evobgp-bird2:${EVOBGP_IMAGE_TAG:-latest}
     restart: unless-stopped
     cap_add:
       - NET_ADMIN
@@ -77,7 +80,7 @@ services:
         max-file: "3"
 
   evobgp-agent:
-    image: git.shts.su/denozord/evobgp-agent:latest
+    image: ${EVOBGP_REGISTRY:-git.shts.su/denozord}/evobgp-agent:${EVOBGP_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       bird2:
@@ -96,7 +99,7 @@ services:
         max-file: "3"
 
   evobgp-all:
-    image: git.shts.su/denozord/evobgp-all:latest
+    image: ${EVOBGP_REGISTRY:-git.shts.su/denozord}/evobgp-all:${EVOBGP_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -127,13 +130,53 @@ services:
         max-file: "3"
 
   evobgp-web:
-    image: git.shts.su/denozord/evobgp-web-all:latest
+    image: ${EVOBGP_REGISTRY:-git.shts.su/denozord}/evobgp-web-all:${EVOBGP_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       evobgp-all:
         condition: service_started
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
+      - traefik.http.routers.evobgp-web.entrypoints=websecure
+      - traefik.http.routers.evobgp-web.tls=true
+      - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
+      - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
+      - traefik.http.services.evobgp-web.loadbalancer.server.port=80
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  evobgp-edge:
+    image: traefik:v3.1
+    restart: unless-stopped
+    depends_on:
+      evobgp-web:
+        condition: service_started
     ports:
-      - "3000:80"
+      - "80:80"
+      - "443:443"
+    environment:
+      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
+    command:
+      - --api.dashboard=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=15
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik_letsencrypt:/letsencrypt
     logging:
       driver: json-file
       options:
@@ -168,3 +211,4 @@ volumes:
   pgdata:
   bird_etc:
   bird_run:
+  traefik_letsencrypt: