refactor: split dynamic config by site

README.md

@@ -13,22 +13,38 @@ Docker Compose deployment for Traefik used as a TCP load balancer with TLS passt
 
 ## Configuration
 
-Edit SNI routes and backend targets in `config/dynamic/tcp-services.yml`:
+Add or edit one file per site under `config/dynamic/`. For example, `config/dynamic/lab-younerd.yml` contains:
 
 ```yaml
+http:
+  routers:
+    lab-younerd-http:
+      entryPoints:
+        - web
+      rule: "Host(`lab.younerd.org`)"
+      service: lab-younerd-http
+
+  services:
+    lab-younerd-http:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:8080"
+
 tcp:
   routers:
-    lab-younerd:
+    lab-younerd-tls:
+      entryPoints:
+        - tls
       rule: "HostSNI(`lab.younerd.org`)"
-      service: lab-younerd
+      service: lab-younerd-tls
       tls:
         passthrough: true
 
   services:
-    lab-younerd:
+    lab-younerd-tls:
       loadBalancer:
         servers:
-          - address: "host.docker.internal:8443"
+          - address: "127.0.0.1:8443"
 ```
 
 `HostSNI(...)` matches the hostname sent by the client during the TLS handshake. This deployment uses host networking so Traefik can reach services bound to the Docker host loopback address, such as `127.0.0.1:8443`.