# Deployment

## Requirements

- Docker Engine with Docker Compose plugin.
- Backend services reachable from the Docker host or container by IP address and port.
- Backend services must terminate TLS and present valid SSL certificates for the expected client names.

## Configuration

Update `config/dynamic/tcp-services.yml` with the required SNI hostnames and backend addresses:

```yaml
tcp:
  routers:
    example:
      rule: "HostSNI(`example.org`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - address: "127.0.0.1:8443"
```

This deployment uses host networking so Traefik can reach services bound to host loopback addresses such as `127.0.0.1:8443`.

HTTP traffic is routed separately with HTTP `Host(...)` rules on port `80`. Configure the HTTP services in `config/dynamic/tcp-services.yml` to point at the local backend port that should handle redirects and ACME challenge paths.

The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:

```yaml
volumes:
  - ./config:/etc/traefik:ro
```

## Ports

- Host `80/tcp`: public HTTP entrypoint handled directly by Traefik through host networking.
- Host `443/tcp`: public TCP TLS passthrough entrypoint handled directly by Traefik through host networking.
- Host `8082/tcp`: Traefik ping entrypoint for the container healthcheck; restrict this port with host firewall rules if needed.

## Deploy

Validate the Compose configuration:

```bash
docker compose config
```

Start the stack:

```bash
docker compose up -d
```

Check status:

```bash
docker compose ps
docker compose logs traefik
```

## Rollback

Stop the stack:

```bash
docker compose down
```

Then revert the deployment commit or restore the previous load-balancer configuration.