# Deployment

## Requirements

- Docker Engine with Docker Compose plugin.
- Backend services reachable from the Docker host or container by IP address and port.
- Backend services must terminate TLS and present valid SSL certificates for the expected client names.

## Configuration

Update `config/dynamic/tcp-services.yml` with the real backend addresses:

```yaml
servers:
  - address: "10.0.0.10:443"
  - address: "10.0.0.11:443"
```

If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.

The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:

```yaml
volumes:
  - ./config:/etc/traefik:ro
```

## Ports

- Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
- Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.

## Deploy

Validate the Compose configuration:

```bash
docker compose config
```

Start the stack:

```bash
docker compose up -d
```

Check status:

```bash
docker compose ps
docker compose logs traefik
```

## Rollback

Stop the stack:

```bash
docker compose down
```

Then revert the deployment commit or restore the previous load-balancer configuration.