bart/platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
platform/docs/adr/0002-traefik-as-edge.md
Bart Van Geyt 9f819df4d9 Phase 0: architecture docs, ADRs, and repo scaffold 
Establish the design foundation for the heleosv2 multi-tenant hosting
platform before any implementation code:

- Monorepo skeleton: docs/, platform-infra/, site-templates/,
  deployments/, control-panel/ with orientation READMEs.
- docs/: roadmap index, architecture + threat model, naming conventions,
  site profiles, provisioning workflow, backup & DR runbook, repo/GitOps
  layout, and the approved architecture plan.
- docs/adr/: 9 ADRs recording the rationale for single-host Compose,
  Traefik edge, nginx+fpm split, shared MariaDB, ZFS-per-customer,
  decoupled backup streams, Forgejo, CLI-first, and SFTP-only.
- Secrets hygiene: .gitignore (only *.enc.* committed) and .gitattributes
  (LF for scripts/Dockerfiles/YAML run on the Linux host).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-07 12:26:00 +02:00

1.1 KiB
Raw Permalink Blame History

ADR 0002 — Traefik as the edge router

Status: Accepted

Context

Multi-tenant host needs TLS termination, automatic certificates, and routing that changes every time a site is added/removed. Alternatives: hand-managed nginx vhosts, Caddy, HAProxy.

Decision

Use Traefik as the single edge router: TLS termination, Let's Encrypt (ACME) automation, and dynamic label-based routing driven by each customer compose project's labels. One shared proxy Docker network connects Traefik to each customer network.

Consequences

  • ✅ Adding a site needs no central config edit — Traefik discovers routes from the new project's labels.
  • ✅ Certificates are automatic and auto-renewed.
  • ✅ Customer containers stay unreachable except through Traefik (it is the only service bridging proxy and a customer network).
  • ❌ Traefik cannot speak FastCGI, so PHP sites still need a per-site web server — see ADR 0003.
  • ⚠️ Traefik is now a critical single component; its config, ACME store, and dashboard must be secured and backed up.