Traefik migration: implementation plan

[aquarion]

Summary

• Implementation plan for migrating firth's Docker container routing from per-service host-nginx configs to Traefik as the single ingress layer
• Covers management of PD Discourse app.yml via a new firth_pddiscourse Ansible role
• Incremental migration approach: Traefik starts on an internal port, nginx proxies to it per-service, then Traefik cuts over to 80/443

Architecture decisions

• Certbot stays for cert management — Traefik reads existing /etc/letsencrypt/live/ certs via file provider, avoiding the need to consolidate two AWS Route53 account profiles (istic-r53, aqcom) and Cloudflare into Traefik ACME config
• Non-Docker services stay on nginx (Thalium, Jellyfin, SFTP-hosted sites) — moved to 127.0.0.1:8180, routed via Traefik file provider. Separate issues filed for containerising these: Containerise and migrate to HTTP-native serving for Traefik compatibility thalium#1215, Migrate from PHP-FPM to Laravel Octane for Docker-native HTTP serving istic/Alchemistic#2, istic/novelathon#182, Containerise and add Laravel Octane for Docker-native HTTP serving (Traefik migration) bloom#27
• PD Discourse managed via new firth_pddiscourse role templating app.yml and running Discourse Launcher

Related issues

• Containerise and migrate to HTTP-native serving for Traefik compatibility thalium#1215
• Migrate from PHP-FPM to Laravel Octane for Docker-native HTTP serving istic/Alchemistic#2
• istic/novelathon#182
• Containerise and add Laravel Octane for Docker-native HTTP serving (Traefik migration) bloom#27

🤖 Generated with Claude Code