# ADR 0002 — Traefik as the edge router

**Status:** Accepted

## Context
Multi-tenant host needs TLS termination, automatic certificates, and routing
that changes every time a site is added/removed. Alternatives: hand-managed
nginx vhosts, Caddy, HAProxy.

## Decision
Use **Traefik** as the single edge router: TLS termination, **Let's Encrypt
(ACME)** automation, and **dynamic label-based routing** driven by each
customer compose project's labels. One shared `proxy` Docker network connects
Traefik to each customer network.

## Consequences
- ✅ Adding a site needs no central config edit — Traefik discovers routes from
  the new project's labels.
- ✅ Certificates are automatic and auto-renewed.
- ✅ Customer containers stay unreachable except through Traefik (it is the only
  service bridging `proxy` and a customer network).
- ❌ Traefik **cannot speak FastCGI**, so PHP sites still need a per-site web
  server — see [ADR 0003](0003-nginx-fpm-per-site.md).
- ⚠️ Traefik is now a critical single component; its config, ACME store, and
  dashboard must be secured and backed up.