Krok 13 (1/3): Traefik uruchomiony, TLS DNS-01 przez OVH

- traefik:v3.7.11 (najnowszy stabilny tag, sprawdzony w Docker Hub)
- DNS-01 challenge, provider ovh, endpoint ovh-ca (region panelu)
- dashboard tylko na 127.0.0.1:8080, dostęp przez tunel SSH
- docker.sock zamontowany read-only
- .env z kluczami API OVH poza repo (chmod 600), .env.example w repo
- zweryfikowane: redirect 80->443, dashboard 200 lokalnie, czyste logi

stacks/traefik/.env.example

@@ -0,0 +1,6 @@
+# Klucze API OVH — DNS-01 dla wildcard *.dfkk.cloud
+# Panel OVH regionu CA: https://ca.api.ovh.com/createToken/
+# Uprawnienia: GET/PUT/POST/DELETE na /domain/zone/*
+OVH_APPLICATION_KEY=
+OVH_APPLICATION_SECRET=
+OVH_CONSUMER_KEY=

stacks/traefik/compose.yaml

@@ -0,0 +1,43 @@
+services:
+  traefik:
+    image: traefik:v3.7.11
+    container_name: traefik
+    restart: unless-stopped
+    command:
+      - --providers.docker=true
+      - --providers.docker.exposedByDefault=false
+      - --providers.docker.network=edge
+      - --entrypoints.web.address=:80
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.traefik.address=:8080
+      - --api.dashboard=true
+      - --certificatesresolvers.ovh.acme.dnschallenge=true
+      - --certificatesresolvers.ovh.acme.dnschallenge.provider=ovh
+      - --certificatesresolvers.ovh.acme.email=k.kruszka@hotmail.com
+      - --certificatesresolvers.ovh.acme.storage=/letsencrypt/acme.json
+      - --log.level=INFO
+    environment:
+      - OVH_ENDPOINT=ovh-ca
+      - OVH_APPLICATION_KEY=${OVH_APPLICATION_KEY}
+      - OVH_APPLICATION_SECRET=${OVH_APPLICATION_SECRET}
+      - OVH_CONSUMER_KEY=${OVH_CONSUMER_KEY}
+    ports:
+      - "80:80"
+      - "443:443"
+      - "127.0.0.1:8080:8080"   # dashboard, wyłącznie przez tunel SSH
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./letsencrypt:/letsencrypt
+    networks:
+      - edge
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.dashboard.rule=Host(`traefik.dfkk.cloud`)
+      - traefik.http.routers.dashboard.entrypoints=traefik
+      - traefik.http.routers.dashboard.service=api@internal
+
+networks:
+  edge:
+    external: true