# Deployment

## Requirements

- Docker Engine with Docker Compose plugin.
- Backend services reachable from the Docker host or container by IP address and port.
- Backend services must terminate TLS and present valid SSL certificates for the expected client names.

## Configuration

Update `config/dynamic/tcp-services.yml` with the required SNI hostnames and backend addresses:

```yaml
tcp:
  routers:
    example:
      rule: "HostSNI(`example.org`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - address: "host.docker.internal:8443"
```

If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.

HTTP-01 certificate challenges are routed separately with HTTP `Host(...)` rules on port `80`. Configure the `*-acme` services in `config/dynamic/tcp-services.yml` to point at the local port where the challenge responder listens.

The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:

```yaml
volumes:
  - ./config:/etc/traefik:ro
```

## Ports

- Host `80/tcp` -> container `8080/tcp`: public HTTP entrypoint for ACME HTTP-01 challenge paths.
- Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
- Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.

## Deploy

Validate the Compose configuration:

```bash
docker compose config
```

Start the stack:

```bash
docker compose up -d
```

Check status:

```bash
docker compose ps
docker compose logs traefik
```

## Rollback

Stop the stack:

```bash
docker compose down
```

Then revert the deployment commit or restore the previous load-balancer configuration.