feat: add traefik tcp load balancer

docs/operations.md

@@ -1,13 +1,57 @@
 # Operations
 
-Describe operational procedures.
+## Startup and shutdown
 
-Include:
+Start Traefik:
 
-- startup and shutdown;
-- health checks;
-- logs;
-- monitoring;
-- backup and restore;
-- routine maintenance;
-- known operational risks.
+```bash
+docker compose up -d
+```
+
+Stop Traefik:
+
+```bash
+docker compose down
+```
+
+Restart after static configuration changes in `config/traefik.yml`:
+
+```bash
+docker compose restart traefik
+```
+
+Dynamic configuration changes under `config/dynamic/` are watched by Traefik and normally do not require a restart.
+
+## Health checks
+
+The container healthcheck runs:
+
+```bash
+traefik healthcheck --ping
+```
+
+Check health with:
+
+```bash
+docker compose ps
+```
+
+## Logs
+
+Traefik logs to container stdout:
+
+```bash
+docker compose logs -f traefik
+```
+
+## Backend maintenance
+
+To remove a backend from rotation, edit `config/dynamic/tcp-services.yml` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.
+
+For backends running on the Docker host, use `host.docker.internal:PORT` rather than `127.0.0.1:PORT`, because `127.0.0.1` inside the container refers to the container itself.
+
+## Known operational risks
+
+- TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
+- Backend certificates and renewal jobs must be monitored on each backend.
+- The default configuration routes all SNI names to the same backend pool. Use more specific `HostSNI(...)` rules if different names need different pools.