docs: update deployment instructions for Auth Portal with Traefik in a single Docker Compose stack

deploy/docker-compose.traefik.yml

@@ -1,20 +1,61 @@
-# Auth Portal behind an existing Traefik (production).
+# Auth Portal + Traefik in one Compose stack (production).
 # Docs: docs/deploy-traefik.md
 #
-# Usage on server:
+# On server:
+#   mkdir -p /opt/auth-portal/data
 #   cp deploy/docker-compose.traefik.yml /opt/auth-portal/docker-compose.yml
-#   # edit networks.proxy.name if your Traefik network is not "proxy"
-#   docker compose --env-file .env up -d
+#   cp deploy/env.traefik.example /opt/auth-portal/.env   # fill secrets
+#   docker login git.shts.su
+#   cd /opt/auth-portal && docker compose pull && docker compose up -d
 
 services:
+  traefik:
+    image: traefik:${TRAEFIK_IMAGE_TAG:-v3.7}
+    container_name: auth-portal-traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - "${TRAEFIK_HTTP_PORT:-80}:80"
+      - "${TRAEFIK_HTTPS_PORT:-443}:443"
+    environment:
+      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN:?set CF_DNS_API_TOKEN in .env}
+      # Optional if DNS token lacks Zone:Read:
+      # CF_ZONE_API_TOKEN: ${CF_ZONE_API_TOKEN:-}
+    command:
+      - --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
+      - --api.dashboard=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=auth-portal
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL:?set LETSENCRYPT_EMAIL in .env}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=15
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik_letsencrypt:/letsencrypt
+    networks:
+      - auth-portal
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
   app:
     image: git.shts.su/denozord/auth-portal:${AUTH_IMAGE_TAG:-latest}
     pull_policy: always
     container_name: auth-portal
     restart: unless-stopped
-    # Do not publish ports — Traefik reaches the container on the shared network.
-    # ports:
-    #   - "8080:8080"
+    depends_on:
+      - traefik
+    # No host ports — only Traefik publishes 80/443.
     env_file:
       - .env
     environment:
@@ -33,14 +74,14 @@ services:
     volumes:
       - ./data:/data
     networks:
-      - proxy
+      - auth-portal
     labels:
       - traefik.enable=true
-      - traefik.docker.network=proxy
+      - traefik.docker.network=auth-portal
       - traefik.http.routers.auth-portal.rule=Host(`${AUTH_DOMAIN:-auth.shnt.top}`)
       - traefik.http.routers.auth-portal.entrypoints=websecure
       - traefik.http.routers.auth-portal.tls=true
-      - traefik.http.routers.auth-portal.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
+      - traefik.http.routers.auth-portal.tls.certresolver=letsencrypt
       - traefik.http.services.auth-portal.loadbalancer.server.port=8080
     healthcheck:
       test:
@@ -60,8 +101,10 @@ services:
         max-size: "10m"
         max-file: "3"
 
+volumes:
+  traefik_letsencrypt:
+    name: auth_portal_traefik_letsencrypt
+
 networks:
-  proxy:
-    external: true
-    # Rename if Traefik uses another network (traefik, web, edge, …):
-    name: proxy
+  auth-portal:
+    name: auth-portal