refactor: split dynamic config by site

docs/adr/0001-traefik-tcp-tls-passthrough.md

@@ -34,7 +34,7 @@ The container does not mount the Docker socket, does not run privileged, drops L
 
 ## Operational impact
 
-Operators update backend IP addresses and ports in `config/dynamic/tcp-services.yml`. Traefik listens directly on host `80/tcp` and `443/tcp`; the ping entrypoint is used by the healthcheck.
+Operators update backend IP addresses and ports in per-site files under `config/dynamic/`. Traefik listens directly on host `80/tcp` and `443/tcp`; the ping entrypoint is used by the healthcheck.
 
 ## Rollback
 

docs/architecture.md

@@ -6,7 +6,7 @@ This project runs Traefik Proxy as a Dockerized TCP load balancer.
 
 - `compose.yaml`: defines the Traefik container, host networking, host-based configuration volume, container hardening, and healthcheck.
 - `config/traefik.yml`: static Traefik configuration for HTTP, TCP TLS, ping, file provider, and logging.
-- `config/dynamic/tcp-services.yml`: dynamic HTTP challenge routers, TCP routers, and backend load-balancer services.
+- `config/dynamic/*.yml`: dynamic per-site HTTP routers, TCP routers, and backend load-balancer services.
 
 ## Data flow
 

docs/deployment.md

@@ -8,7 +8,7 @@
 
 ## Configuration
 
-Update `config/dynamic/tcp-services.yml` with the required SNI hostnames and backend addresses:
+Add or update a per-site file under `config/dynamic/` with the required hostnames and backend addresses:
 
 ```yaml
 tcp:
@@ -28,7 +28,9 @@ tcp:
 
 This deployment uses host networking so Traefik can reach services bound to host loopback addresses such as `127.0.0.1:8443`.
 
-HTTP traffic is routed separately with HTTP `Host(...)` rules on port `80`. Configure the HTTP services in `config/dynamic/tcp-services.yml` to point at the local backend port that should handle redirects and ACME challenge paths.
+HTTP traffic is routed separately with HTTP `Host(...)` rules on port `80`. Configure the HTTP service in the same per-site file to point at the local backend port that should handle redirects and ACME challenge paths.
+
+Keep each site's HTTP and TCP routers in the same dynamic file, for example `config/dynamic/lab-younerd.yml` or `config/dynamic/azionelab.yml`.
 
 The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:
 

docs/operations.md

@@ -46,11 +46,11 @@ docker compose logs -f traefik
 
 ## Backend maintenance
 
-To remove a backend from rotation, edit `config/dynamic/tcp-services.yml` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.
+To remove a backend from rotation, edit that site's file under `config/dynamic/` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.
 
 This deployment uses host networking. For backends running on the Docker host, use `127.0.0.1:PORT` when the service is bound to host loopback.
 
-For HTTP on port `80`, update the HTTP services in `config/dynamic/tcp-services.yml` to match the local backend ports that handle redirects and ACME challenge paths.
+For HTTP on port `80`, update the HTTP services in the relevant site file under `config/dynamic/` to match the local backend ports that handle redirects and ACME challenge paths.
 
 ## Known operational risks
 

docs/runbook.md

@@ -16,7 +16,7 @@ docker compose down
 
 ### Update backend targets
 
-1. Edit `config/dynamic/tcp-services.yml`.
+1. Edit the relevant site file under `config/dynamic/`.
 2. Run `docker compose config` to catch Compose-level errors.
 3. Watch Traefik logs:
 
@@ -49,7 +49,7 @@ Check that port `80/tcp` is reachable from the internet and that the matching HT
 
 ### Wrong certificate is presented
 
-Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in `config/dynamic/tcp-services.yml`.
+Because TLS is passed through, the certificate comes from the selected backend. Check backend certificate configuration and SNI routing rules in the relevant file under `config/dynamic/`.
 
 ## Rollback