chore: align Traefik proxy setup and production deploy workflow

docker-compose.yml

@@ -4,28 +4,40 @@ services:
       context: .
       dockerfile: Dockerfile
     container_name: moh-sass-app
-    command: sh -c "npm install && npm run dev -- --hostname 0.0.0.0 --port 3000"
+    restart: unless-stopped
     environment:
+      NODE_ENV: production
       NEXT_TELEMETRY_DISABLED: "1"
-      WATCHPACK_POLLING: "true"
-      DATABASE_URL: postgresql://postgres:postgres@db:5432/moh_sass?schema=public
+      DATABASE_URL: ${DATABASE_URL}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:-change-me}
       ADMIN_AUTH_SECRET: ${ADMIN_AUTH_SECRET:-change-me-long-secret}
       ROOT_BASIC_AUTH_USER: ${ROOT_BASIC_AUTH_USER:-root}
       ROOT_BASIC_AUTH_PASS: ${ROOT_BASIC_AUTH_PASS:-change-me-root}
-    volumes:
-      - .:/app
-      - app_node_modules:/app/node_modules
-      - app_next:/app/.next
-    ports:
-      - "3000:3000"
     depends_on:
       db:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:3000/api/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.mohfarawati.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`)"
+      - "traefik.http.routers.mohfarawati.entrypoints=websecure"
+      - "traefik.http.routers.mohfarawati.tls=true"
+      - "traefik.http.routers.mohfarawati.tls.certresolver=cf"
+      - "traefik.http.services.mohfarawati.loadbalancer.server.port=3000"
+    networks:
+      - appnet
+      - proxy
 
   db:
     image: postgres:16-alpine
     container_name: moh-sass-db
+    restart: unless-stopped
     environment:
       POSTGRES_DB: moh_sass
       POSTGRES_USER: postgres
@@ -37,8 +49,14 @@ services:
       interval: 5s
       timeout: 5s
       retries: 20
+    networks:
+      - appnet
 
 volumes:
-  app_node_modules:
-  app_next:
   postgres_data:
+
+networks:
+  appnet:
+  proxy:
+    external: true
+    name: proxy