feat: add traefik tcp load balancer

docs/deployment.md

@@ -1,15 +1,62 @@
 # Deployment
 
-Describe how this project is deployed.
+## Requirements
 
-Include:
+- Docker Engine with Docker Compose plugin.
+- Backend services reachable from the Docker host or container by IP address and port.
+- Backend services must terminate TLS and present valid SSL certificates for the expected client names.
 
-- environments;
-- Docker/Compose usage;
-- required configuration;
-- secrets handling;
-- exposed ports;
-- volumes;
-- networks;
-- deployment commands;
-- rollback procedure.
+## Configuration
+
+Update `config/dynamic/tcp-services.yml` with the real backend addresses:
+
+```yaml
+servers:
+  - address: "10.0.0.10:443"
+  - address: "10.0.0.11:443"
+```
+
+If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.
+
+The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:
+
+```yaml
+volumes:
+  - ./config:/etc/traefik:ro
+```
+
+## Ports
+
+- Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
+- Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.
+
+## Deploy
+
+Validate the Compose configuration:
+
+```bash
+docker compose config
+```
+
+Start the stack:
+
+```bash
+docker compose up -d
+```
+
+Check status:
+
+```bash
+docker compose ps
+docker compose logs traefik
+```
+
+## Rollback
+
+Stop the stack:
+
+```bash
+docker compose down
+```
+
+Then revert the deployment commit or restore the previous load-balancer configuration.