feat: add traefik tcp load balancer

docs/runbook.md

@@ -1,19 +1,58 @@
 # Runbook
 
-Operational runbook for this project.
-
 ## Common tasks
 
-Document routine operational tasks here.
+### Start the load balancer
+
+```bash
+docker compose up -d
+```
+
+### Stop the load balancer
+
+```bash
+docker compose down
+```
+
+### Update backend targets
+
+1. Edit `config/dynamic/tcp-services.yml`.
+2. Run `docker compose config` to catch Compose-level errors.
+3. Watch Traefik logs:
+
+```bash
+docker compose logs -f traefik
+```
+
+Dynamic file-provider changes are watched by Traefik.
 
 ## Troubleshooting
 
-Document known issues, symptoms, checks, and remediation steps.
+### Container is unhealthy
+
+Check container status and logs:
+
+```bash
+docker compose ps
+docker compose logs traefik
+```
+
+Confirm that `config/traefik.yml` is mounted and that the ping entrypoint is enabled.
+
+### Clients cannot connect
+
+Check that the host is listening on `443/tcp`, firewall rules allow inbound traffic, and backend IP addresses are reachable from the Traefik container. For services on the Docker host, configure backends as `host.docker.internal:PORT`.
+
+### Wrong certificate is presented
+
+Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in `config/dynamic/tcp-services.yml`.
 
 ## Rollback
 
-Document rollback procedures here.
+Stop the Compose stack:
 
-## Emergency contacts
+```bash
+docker compose down
+```
 
-Document project-specific escalation paths if appropriate.
+Revert the deployment commit or restore the previous load-balancer configuration.