From d7475b2bc3edf0027e0fa57e3997c084c36a1b74 Mon Sep 17 00:00:00 2001
From: IwanIDev <iwan@iwani.dev>
Date: Fri, 20 Mar 2026 13:52:35 +0000
Subject: Add Traefik configuration and environment variables for Docker
 deployment

---
 .env.example     |  5 +++++
 README.md        | 11 +++++++++++
 docker-stack.yml | 16 ++++++++++------
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/.env.example b/.env.example
index fece7bb..76bb417 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,8 @@
 VITE_DRUPAL_BASE_URL=http://localhost:5173
 VITE_DRUPAL_API_PREFIX=/drupal-api/jsonapi
 VITE_DRUPAL_AUTH_TOKEN=
+
+# Docker Swarm + Traefik deployment variables
+PORTFOLIO_HOST=portfolio.example.com
+TRAEFIK_NETWORK=traefik-public
+TRAEFIK_ENTRYPOINTS=web
diff --git a/README.md b/README.md
index a059811..15bc22f 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,17 @@ Set these in your GitHub repository before deploying:
 - Repository variable: `VITE_DRUPAL_BASE_URL`
 - Repository variable: `VITE_DRUPAL_API_PREFIX` (optional)
 - Repository secret: `VITE_DRUPAL_AUTH_TOKEN` (optional)
+- Repository variable: `PORTFOLIO_HOST` (domain Traefik should match, for example `portfolio.example.com`)
+- Repository variable: `TRAEFIK_NETWORK` (defaults to `traefik-public`)
+- Repository variable: `TRAEFIK_ENTRYPOINTS` (defaults to `web`, use `websecure` for TLS entrypoint)
+
+The `web` service is routed by Traefik (no direct host port publish on the app service). Your host Nginx can continue acting as the public reverse proxy by forwarding to Traefik's exposed entrypoint(s).
+
+Before first deploy, ensure the external Traefik overlay network exists in Swarm:
+
+```bash
+docker network create --driver overlay traefik-public
+```
 
 Existing deploy flow:
 
diff --git a/docker-stack.yml b/docker-stack.yml
index 6512e2e..b747839 100644
--- a/docker-stack.yml
+++ b/docker-stack.yml
@@ -3,17 +3,12 @@ version: '3.8'
 services:
   web:
     image: ${IMAGE_NAME}
-    ports:
-      - target: 80
-        published: 8280
-        protocol: tcp
-        mode: host
     deploy:
       replicas: 1
       update_config:
         parallelism: 1
         delay: 10s
-        order: start-first
+        order: stop-first
       restart_policy:
         condition: on-failure
         delay: 5s
@@ -21,8 +16,14 @@ services:
         window: 120s
       labels:
         - "app=vite-portfolio"
+        - "traefik.enable=true"
+        - "traefik.docker.network=${TRAEFIK_NETWORK:-traefik-public}"
+        - "traefik.http.routers.vite-portfolio.rule=Host(`${PORTFOLIO_HOST:-localhost}`)"
+        - "traefik.http.routers.vite-portfolio.entrypoints=${TRAEFIK_ENTRYPOINTS:-web}"
+        - "traefik.http.services.vite-portfolio.loadbalancer.server.port=80"
     networks:
       - portfolio-network
+      - traefik-public
 
   drupal:
     image: drupal:10-apache
@@ -77,3 +78,6 @@ volumes:
 networks:
   portfolio-network:
     driver: overlay
+  traefik-public:
+    external: true
+    name: ${TRAEFIK_NETWORK:-traefik-public}
-- 
cgit