CONFIGURED - Wire docker-compose to Traefik for first deploy

- Join the app to the external proxy network and drop the published host port
- Add Traefik labels for mohfarawati.de, www, and root.mohfarawati.de
- Parametrize network/entrypoint/certresolver via TRAEFIK_* env with sane defaults
- Pass ADMIN_HOST to the app and document production env in .env.example

.env.example

@@ -18,3 +18,14 @@ ADMIN_PASSWORD="change-me"
 ADMIN_AUTH_SECRET="replace-with-a-long-random-secret"
 ADMIN_BASIC_AUTH_USER="change-me"
 ADMIN_BASIC_AUTH_PASS="change-me"
+
+# --- Production only (server .env) ---
+# The full stack runs via docker-compose.yml behind Traefik. On the server set:
+#   NEXT_PUBLIC_SITE_URL="https://mohfarawati.de"
+#   NEXT_PUBLIC_ADMIN_URL="https://root.mohfarawati.de"
+#   ADMIN_HOST="root.mohfarawati.de"
+# Traefik wiring (override only if your server differs from the defaults):
+#   TRAEFIK_NETWORK="proxy"          # the external network Traefik is on
+#   TRAEFIK_ENTRYPOINT="websecure"   # HTTPS entrypoint name
+#   TRAEFIK_CERTRESOLVER="cf"        # cert resolver that covers *.mohfarawati.de
+# DATABASE_URL is set by docker-compose.yml to the internal db service — do not set it here.

docker-compose.yml

@@ -12,6 +12,7 @@ services:
       NEXT_TELEMETRY_DISABLED: "1"
       NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-https://mohfarawati.de}
       NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL:-https://root.mohfarawati.de}
+      ADMIN_HOST: ${ADMIN_HOST:-root.mohfarawati.de}
       SITE_RUNTIME_ORIGIN: ${SITE_RUNTIME_ORIGIN:-http://127.0.0.1:3000}
       DATABASE_URL: postgresql://postgres:postgres@db:5432/moh_sass?schema=public
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}
@@ -27,11 +28,25 @@ services:
       timeout: 5s
       retries: 10
       start_period: 20s
-    ports:
+    labels:
-      - "${PORT:-3014}:3000"
+      - traefik.enable=true
+      - traefik.docker.network=${TRAEFIK_NETWORK:-proxy}
+      # HTTPS router — public site + www + admin subdomain all hit this one app;
+      # the app's middleware routes root.mohfarawati.de to the admin internally.
+      - "traefik.http.routers.sass.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`) || Host(`root.mohfarawati.de`)"
+      - traefik.http.routers.sass.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
+      - traefik.http.routers.sass.tls=true
+      - traefik.http.routers.sass.tls.certresolver=${TRAEFIK_CERTRESOLVER:-cf}
+      - traefik.http.services.sass.loadbalancer.server.port=3000
+      # HTTP router → redirect to HTTPS
+      - "traefik.http.routers.sass-http.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`) || Host(`root.mohfarawati.de`)"
+      - traefik.http.routers.sass-http.entrypoints=web
+      - traefik.http.routers.sass-http.middlewares=sass-redirect
+      - traefik.http.middlewares.sass-redirect.redirectscheme.scheme=https
     volumes:
       - media_uploads:/app/public/uploads/media
     networks:
+      - proxy
       - appnet
 
   db:
@@ -57,3 +72,8 @@ volumes:
 
 networks:
   appnet:
+  # Shared external Traefik network (same one the other projects use).
+  # Override the name per server with TRAEFIK_NETWORK in .env.
+  proxy:
+    external: true
+    name: ${TRAEFIK_NETWORK:-proxy}