From 29bc47da4cec4c0421643de772dd1526bd2f4a97 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Fri, 24 Apr 2026 08:28:18 -0500
Subject: [PATCH] Add Traefik production compose override

---
 PLAN.md                    |  5 +++++
 README.md                  |  5 +++++
 compose.traefik.yml.sample | 32 ++++++++++++++++++++++++++++++++
 scripts/prod-up.sh         | 22 ++++++++++++++++++++++
 4 files changed, 64 insertions(+)
 create mode 100644 compose.traefik.yml.sample
 create mode 100755 scripts/prod-up.sh

diff --git a/PLAN.md b/PLAN.md
index 5e29e2b..222fa96 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -35,6 +35,11 @@
 - The splash artwork in `frontend/public/splash-art.svg` still serves as the editable vector source for the startup images in `frontend/public/`.
 - The existing `frontend/public/icon.svg` already covers the app icon artwork, so no separate raster-to-vector conversion was needed there.
 
+## Completed Ops Helpers
+- Added a detached production compose launcher at `scripts/prod-up.sh` so the stack can be started without attaching the terminal to container output.
+- Added a Traefik compose override sample at `compose.traefik.yml.sample` for production routing and proxy-network attachment.
+- The production launcher now targets only `db`, `backend`, and `frontend`, keeping the dev Caddy proxy out of the production path.
+
 ## Storage Status
 - Backend media persists in the `backend-media` named Docker volume.
 
diff --git a/README.md b/README.md
index fdca00b..0fa5632 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,11 @@ WalkUp is a collaborative baseball walk-up song app built as a React PWA with a
 - `./scripts/dev-logs.sh` captures current service logs to `logs/docker-services.log`.
 - Use those files when you want me to inspect startup failures or runtime errors from the Docker stack.
 
+## Production
+- Copy `compose.traefik.yml.sample` to `compose.traefik.yml` and adjust it for your deployment.
+- `./scripts/prod-up.sh` starts `db`, `backend`, and `frontend` in detached mode with that Traefik override.
+- Use `docker compose logs db backend frontend` when you need live service output from that detached stack.
+
 ## TeamSnap Secrets
 - TeamSnap credentials are expected through Docker secrets, not plain environment variables.
 - The backend reads `/run/secrets/teamsnap_client_id` and `/run/secrets/teamsnap_client_secret` by default.
diff --git a/compose.traefik.yml.sample b/compose.traefik.yml.sample
new file mode 100644
index 0000000..b594ee0
--- /dev/null
+++ b/compose.traefik.yml.sample
@@ -0,0 +1,32 @@
+services:
+  backend:
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.walkup-backend.rule=Host(`${APP_HOST}`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.walkup-backend.entrypoints=websecure"
+      - "traefik.http.routers.walkup-backend.tls=true"
+      - "traefik.http.routers.walkup-backend.priority=100"
+      - "traefik.http.routers.walkup-backend.middlewares=walkup-api-strip"
+      - "traefik.http.services.walkup-backend.loadbalancer.server.port=8000"
+      - "traefik.http.middlewares.walkup-api-strip.stripprefix.prefixes=/api"
+
+  frontend:
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.walkup-frontend.rule=Host(`${APP_HOST}`)"
+      - "traefik.http.routers.walkup-frontend.entrypoints=websecure"
+      - "traefik.http.routers.walkup-frontend.tls=true"
+      - "traefik.http.routers.walkup-frontend.priority=1"
+      - "traefik.http.services.walkup-frontend.loadbalancer.server.port=5173"
+
+networks:
+  proxy:
+    external: true
diff --git a/scripts/prod-up.sh b/scripts/prod-up.sh
new file mode 100755
index 0000000..b166cd7
--- /dev/null
+++ b/scripts/prod-up.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OVERRIDE_FILE="${ROOT_DIR}/compose.traefik.yml"
+
+if [[ ! -f "${OVERRIDE_FILE}" ]]; then
+  cat <<'EOF'
+Missing compose.traefik.yml.
+
+Copy compose.traefik.yml.sample to compose.traefik.yml, adjust the host and
+network settings for production, then rerun this script.
+EOF
+  exit 1
+fi
+
+cd "${ROOT_DIR}"
+docker compose -f docker-compose.yml -f compose.traefik.yml up --build -d db backend frontend "$@"
+
+echo "Started the compose stack in detached mode."
+echo "Use docker compose logs db backend frontend to inspect service output."