# Deployment

## Requirements

- Docker Engine with Docker Compose plugin.
- Backend services reachable from the Docker host or container by IP address and port.
- Backend services must terminate TLS and present valid SSL certificates for the expected client names.

## Configuration

Add or update a per-site file under `config/dynamic/` with the required hostnames and backend addresses:

```yaml
tcp:
  routers:
    example:
      rule: "HostSNI(`example.org`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - address: "127.0.0.1:8443"
```

This deployment uses host networking so Traefik can reach services bound to host loopback addresses such as `127.0.0.1:8443`.

HTTP traffic is routed separately with HTTP `Host(...)` rules on port `80`. Configure the HTTP service in the same per-site file to point at the local backend port that should handle redirects and ACME challenge paths.

Keep each site's HTTP and TCP routers in the same dynamic file, for example `config/dynamic/lab-younerd.yml` or `config/dynamic/azionelab.yml`.

The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:

```yaml
volumes:
  - ./config:/etc/traefik:ro
```

## Ports

- Host `80/tcp`: public HTTP entrypoint handled directly by Traefik through host networking.
- Host `443/tcp`: public TCP TLS passthrough entrypoint handled directly by Traefik through host networking.
- Host `8082/tcp`: Traefik ping entrypoint for the container healthcheck; restrict this port with host firewall rules if needed.

## Deploy

Validate the Compose configuration:

```bash
docker compose config
```

Start the stack:

```bash
docker compose up -d
```

Check status:

```bash
docker compose ps
docker compose logs traefik
```

## Rollback

Stop the stack:

```bash
docker compose down
```

Then revert the deployment commit or restore the previous load-balancer configuration.