Add Traefik production compose override

PLAN.md

@@ -35,6 +35,11 @@
 - The splash artwork in `frontend/public/splash-art.svg` still serves as the editable vector source for the startup images in `frontend/public/`.
 - The existing `frontend/public/icon.svg` already covers the app icon artwork, so no separate raster-to-vector conversion was needed there.
 
+## Completed Ops Helpers
+- Added a detached production compose launcher at `scripts/prod-up.sh` so the stack can be started without attaching the terminal to container output.
+- Added a Traefik compose override sample at `compose.traefik.yml.sample` for production routing and proxy-network attachment.
+- The production launcher now targets only `db`, `backend`, and `frontend`, keeping the dev Caddy proxy out of the production path.
+
 ## Storage Status
 - Backend media persists in the `backend-media` named Docker volume.
 

README.md

@@ -31,6 +31,11 @@ WalkUp is a collaborative baseball walk-up song app built as a React PWA with a
 - `./scripts/dev-logs.sh` captures current service logs to `logs/docker-services.log`.
 - Use those files when you want me to inspect startup failures or runtime errors from the Docker stack.
 
+## Production
+- Copy `compose.traefik.yml.sample` to `compose.traefik.yml` and adjust it for your deployment.
+- `./scripts/prod-up.sh` starts `db`, `backend`, and `frontend` in detached mode with that Traefik override.
+- Use `docker compose logs db backend frontend` when you need live service output from that detached stack.
+
 ## TeamSnap Secrets
 - TeamSnap credentials are expected through Docker secrets, not plain environment variables.
 - The backend reads `/run/secrets/teamsnap_client_id` and `/run/secrets/teamsnap_client_secret` by default.

compose.traefik.yml.sample

@@ -0,0 +1,32 @@
+services:
+  backend:
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.walkup-backend.rule=Host(`${APP_HOST}`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.walkup-backend.entrypoints=websecure"
+      - "traefik.http.routers.walkup-backend.tls=true"
+      - "traefik.http.routers.walkup-backend.priority=100"
+      - "traefik.http.routers.walkup-backend.middlewares=walkup-api-strip"
+      - "traefik.http.services.walkup-backend.loadbalancer.server.port=8000"
+      - "traefik.http.middlewares.walkup-api-strip.stripprefix.prefixes=/api"
+
+  frontend:
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.walkup-frontend.rule=Host(`${APP_HOST}`)"
+      - "traefik.http.routers.walkup-frontend.entrypoints=websecure"
+      - "traefik.http.routers.walkup-frontend.tls=true"
+      - "traefik.http.routers.walkup-frontend.priority=1"
+      - "traefik.http.services.walkup-frontend.loadbalancer.server.port=5173"
+
+networks:
+  proxy:
+    external: true

scripts/prod-up.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OVERRIDE_FILE="${ROOT_DIR}/compose.traefik.yml"
+
+if [[ ! -f "${OVERRIDE_FILE}" ]]; then
+  cat <<'EOF'
+Missing compose.traefik.yml.
+
+Copy compose.traefik.yml.sample to compose.traefik.yml, adjust the host and
+network settings for production, then rerun this script.
+EOF
+  exit 1
+fi
+
+cd "${ROOT_DIR}"
+docker compose -f docker-compose.yml -f compose.traefik.yml up --build -d db backend frontend "$@"
+
+echo "Started the compose stack in detached mode."
+echo "Use docker compose logs db backend frontend to inspect service output."