feat: add Traefik labels and domain env vars to docker-compose

.env.example

@@ -20,3 +20,12 @@ AUTHENTIK_HOST=https://auth.{YOUR_DOMAIN}
 # ── Wartungsmodus ─────────────────────────────────────────────────────────────
 # Auf 1 setzen um die gesamte Seite in den Wartungsmodus zu schalten.
 # MAINTENANCE_MODE=1
+
+# ── Docker / Deployment ───────────────────────────────────────────────────────
+# Nur relevant wenn du docker-compose.yml nutzt.
+# Ohne Traefik: Ports werden direkt exponiert (Defaults: 3000 / 3001)
+# Mit Traefik:  Ports auskommentieren, Labels und networks einkommentieren.
+NOZ_DOMAIN=noz.{YOUR_DOMAIN}
+STUDIO_DOMAIN=studio.{YOUR_DOMAIN}
+NOZ_PORT=3000
+STUDIO_PORT=3001

docker-compose.yml

@@ -3,19 +3,47 @@ services:
     build: .
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "${NOZ_PORT:-3000}:3000"
     volumes:
       - ./content:/app/content
       - ./noosphere.toml:/app/noosphere.toml:ro
       - noz-index:/app/.noosphere-index
     env_file:
       - .env.local
+    # Traefik — uncomment and remove ports above when running behind Traefik
+    # networks:
+    #   - frontend
+    # labels:
+    #   - "traefik.enable=true"
+    #   - "traefik.http.routers.noz.rule=Host(`${NOZ_DOMAIN}`)"
+    #   - "traefik.http.routers.noz.entrypoints=websecure"
+    #   - "traefik.http.routers.noz.tls.certresolver=ionos"
+    #   - "traefik.http.services.noz.loadbalancer.server.port=3000"
+    #   # /vault protected by Authentik SSO (requires infra/traefik/authentik-middleware.yml)
+    #   - "traefik.http.routers.noz-vault.rule=Host(`${NOZ_DOMAIN}`) && PathPrefix(`/vault`)"
+    #   - "traefik.http.routers.noz-vault.entrypoints=websecure"
+    #   - "traefik.http.routers.noz-vault.tls.certresolver=ionos"
+    #   - "traefik.http.routers.noz-vault.middlewares=authentik@file"
+    #   - "traefik.http.routers.noz-vault.priority=10"
 
   noz-studio:
     build: ../noz-studio
     restart: unless-stopped
     ports:
-      - "3001:3001"
+      - "${STUDIO_PORT:-3001}:3001"
+    # networks:
+    #   - frontend
+    # labels:
+    #   - "traefik.enable=true"
+    #   - "traefik.http.routers.noz-studio.rule=Host(`${STUDIO_DOMAIN}`)"
+    #   - "traefik.http.routers.noz-studio.entrypoints=websecure"
+    #   - "traefik.http.routers.noz-studio.tls.certresolver=ionos"
+    #   - "traefik.http.routers.noz-studio.middlewares=authentik@file"
+    #   - "traefik.http.services.noz-studio.loadbalancer.server.port=3001"
 
 volumes:
   noz-index:
+
+# networks:
+#   frontend:
+#     external: true