Add production-ready Traefik configuration with secure headers, TLS settings, and rate limiting

docker-compose.prod.yml

@@ -0,0 +1,29 @@
+services:
+  traefik:
+    # Use hardened Traefik config in production (no staging CA, no tracing/metrics)
+    volumes:
+      - ./services/traefik/traefik.prod.yml:/etc/traefik/traefik.yml:ro
+      - ./services/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
+      - ./services/traefik/acme.json:/acme.json
+    ports:
+      - "80:80"
+      - "443:443"
+
+  # Remove public exposure of internal datastores in production
+  db:
+    ports: []
+
+  redis:
+    ports: []
+
+## Usage (examples):
+## - With explicit files (recommended):
+##   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d traefik caddy php1 php2 php3 php4 php5 db redis
+##
+## - Or set COMPOSE_FILE for the shell session (PowerShell on Windows):
+##   $env:COMPOSE_FILE = "docker-compose.yml;docker-compose.prod.yml"
+##   docker compose up -d traefik caddy php1 php2 php3 php4 php5 db redis
+##
+## Notes:
+## - Traefik uses Let’s Encrypt production. Ensure DNS A/AAAA records for api.truckwash.dk and traefik.truckwash.dk point to this host and ports 80/443 are reachable.
+## - The dashboard is protected by basic auth and an IP allowlist (defined in dynamic.yml). Replace the bcrypt hash before enabling in production.