Add Traefik configuration and environment variables for Docker deployment

3 files changed, 26 insertions, 6 deletions

diff --git a/.env.example b/.env.example
index fece7bb..76bb417 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,8 @@
 VITE_DRUPAL_BASE_URL=http://localhost:5173
 VITE_DRUPAL_API_PREFIX=/drupal-api/jsonapi
 VITE_DRUPAL_AUTH_TOKEN=
+
+# Docker Swarm + Traefik deployment variables
+PORTFOLIO_HOST=portfolio.example.com
+TRAEFIK_NETWORK=traefik-public
+TRAEFIK_ENTRYPOINTS=web
diff --git a/README.md b/README.md
index a059811..15bc22f 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,17 @@ Set these in your GitHub repository before deploying:
 - Repository variable: `VITE_DRUPAL_BASE_URL`
 - Repository variable: `VITE_DRUPAL_API_PREFIX` (optional)
 - Repository secret: `VITE_DRUPAL_AUTH_TOKEN` (optional)
+- Repository variable: `PORTFOLIO_HOST` (domain Traefik should match, for example `portfolio.example.com`)
+- Repository variable: `TRAEFIK_NETWORK` (defaults to `traefik-public`)
+- Repository variable: `TRAEFIK_ENTRYPOINTS` (defaults to `web`, use `websecure` for TLS entrypoint)
+
+The `web` service is routed by Traefik (no direct host port publish on the app service). Your host Nginx can continue acting as the public reverse proxy by forwarding to Traefik's exposed entrypoint(s).
+
+Before first deploy, ensure the external Traefik overlay network exists in Swarm:
+
+```bash
+docker network create --driver overlay traefik-public
+```
 
 Existing deploy flow:
 
diff --git a/docker-stack.yml b/docker-stack.yml
index 6512e2e..b747839 100644
--- a/docker-stack.yml
+++ b/docker-stack.yml
@@ -3,17 +3,12 @@ version: '3.8'
 services:
   web:
     image: ${IMAGE_NAME}
-    ports:
-      - target: 80
-        published: 8280
-        protocol: tcp
-        mode: host
     deploy:
       replicas: 1
       update_config:
         parallelism: 1
         delay: 10s
-        order: start-first
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -21,8 +16,14 @@ services:
         window: 120s
       labels:
         - "app=vite-portfolio"
+        - "traefik.enable=true"
+        - "traefik.docker.network=${TRAEFIK_NETWORK:-traefik-public}"
+        - "traefik.http.routers.vite-portfolio.rule=Host(`${PORTFOLIO_HOST:-localhost}`)"
+        - "traefik.http.routers.vite-portfolio.entrypoints=${TRAEFIK_ENTRYPOINTS:-web}"
+        - "traefik.http.services.vite-portfolio.loadbalancer.server.port=80"
     networks:
       - portfolio-network
+      - traefik-public
 
   drupal:
     image: drupal:10-apache
@@ -77,3 +78,6 @@ volumes:
 networks:
   portfolio-network:
     driver: overlay
+  traefik-public:
+    external: true
+    name: ${TRAEFIK_NETWORK:-traefik-public}