Add Traefik and Caddy configurations for reverse proxy setup and internal HTTP handling.

services/caddy/Caddyfile

@@ -0,0 +1,34 @@
+{
+    # Traefik terminates TLS; Caddy serves HTTP behind Traefik only
+    auto_https off
+}
+
+:80 {
+    encode gzip
+    root * /var/www/html
+
+    # CORS headers matching prior Nginx behavior
+    @options method OPTIONS
+    header {
+        Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
+        Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
+        Access-Control-Allow-Credentials true
+        Access-Control-Allow-Origin "*"
+    }
+    respond @options 204
+
+    # PHP handling via FastCGI to php-fpm pool
+    php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000
+
+    try_files {path} {path}/ /index.php
+    file_server
+
+    log {
+        output file /var/log/caddy/access.log {
+            roll_size 10MiB
+            roll_keep 5
+            roll_keep_for 720h
+        }
+        format json
+    }
+}

services/traefik/dynamic.yml

@@ -0,0 +1,41 @@
+http:
+  routers:
+    # Nextcloud proxy (directly from Traefik to external server)
+    cloud:
+      rule: Host(`cloud.truckwash.dk`)
+      entryPoints: [websecure]
+      service: cloud-svc
+      tls:
+        certResolver: le
+    cloud-http:
+      rule: Host(`cloud.truckwash.dk`)
+      entryPoints: [web]
+      middlewares: [redirect-to-https]
+      service: cloud-svc
+
+    # Dashboard routers are declared via labels; middlewares are defined below.
+
+  middlewares:
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
+    dashboard-auth:
+      basicAuth:
+        # IMPORTANT: Replace REPLACE_WITH_BCRYPT_HASH with a bcrypt/htpasswd hash for user 'truckwash'.
+        # Example command to generate (once Docker is available):
+        #   docker run --rm httpd:2.4-alpine htpasswd -nbB truckwash 'w5j9MlEVz62Exm6r'
+        users:
+          - "truckwash:REPLACE_WITH_BCRYPT_HASH"
+    dashboard-allow-local:
+      ipWhiteList:
+        sourceRange:
+          - 127.0.0.1/32
+          - 10.0.0.0/8
+          - 172.16.0.0/12
+          - 192.168.0.0/16
+
+  services:
+    cloud-svc:
+      loadBalancer:
+        servers:
+          - url: "http://94.130.142.41:11000"

services/traefik/traefik.yml

@@ -0,0 +1,31 @@
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+
+providers:
+  docker:
+    exposedByDefault: false
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true
+
+api:
+  dashboard: true
+
+log:
+  level: INFO
+
+accessLog: {}
+
+certificatesResolvers:
+  le:
+    acme:
+      email: jb@truckwash.dk
+      storage: /acme.json
+      httpChallenge:
+        entryPoint: web
+      # Using Let's Encrypt STAGING for local runs to avoid rate limits.
+      # Remove the following caServer line to switch to production.
+      caServer: https://acme-staging-v02.api.letsencrypt.org/directory