deploy: Traefik hosts + registry images for shop/admin/api

Publish nginx/API images from CI and deploy on the Pi with
shop.zea.lt, admin.zea.lt, and api.iled.zea.lt.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker/Dockerfile.admin

@@ -0,0 +1,4 @@
+FROM nginx:1.27-alpine
+COPY src/admin/dist/admin/browser /usr/share/nginx/html
+COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80

docker/Dockerfile.api

@@ -1,7 +1,7 @@
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src
-COPY . .
-RUN dotnet restore iLED.sln
+COPY src/backend/ .
+RUN dotnet restore iLED.slnx
 RUN dotnet publish src/iLED.Api/iLED.Api.csproj -c Release -o /app/publish
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0

docker/Dockerfile.shop

@@ -0,0 +1,4 @@
+FROM nginx:1.27-alpine
+COPY src/shop/dist/shop/browser /usr/share/nginx/html
+COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80

docker/docker-compose.yml

@@ -2,58 +2,57 @@ services:
   postgres:
     image: postgres:16-alpine
     container_name: iled-postgres
+    restart: always
     environment:
-      POSTGRES_DB: iled
-      POSTGRES_USER: iled
-      POSTGRES_PASSWORD: iled123
-    ports:
-      - "5433:5432"
+      POSTGRES_DB: ${POSTGRES_DB:-iled}
+      POSTGRES_USER: ${POSTGRES_USER:-iled}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-iled123}
     volumes:
       - iled_pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U iled -d iled"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - iled
+      - homelab
 
   redis:
     image: redis:7-alpine
     container_name: iled-redis
-    ports:
-      - "6379:6379"
+    restart: always
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - iled
 
-  # Backend observability: logs + metrics + traces (UI http://localhost:5080)
-  # Login: root@iled.local / Complexpass#123
   openobserve:
     image: public.ecr.aws/zinclabs/openobserve:latest
     container_name: iled-openobserve
+    restart: always
     environment:
-      ZO_ROOT_USER_EMAIL: root@iled.local
-      ZO_ROOT_USER_PASSWORD: Complexpass#123
+      ZO_ROOT_USER_EMAIL: ${ZO_ROOT_USER_EMAIL:-root@iled.local}
+      ZO_ROOT_USER_PASSWORD: ${ZO_ROOT_USER_PASSWORD:-Complexpass#123}
       ZO_DATA_DIR: /data
-    ports:
-      - "5080:5080"
     volumes:
       - iled_openobserve:/data
+    networks:
+      - iled
 
   api:
-    build:
-      context: ../src/backend
-      dockerfile: ../../docker/Dockerfile.api
+    image: registry.zea.lt/miczek/iled-api:latest
     container_name: iled-api
-    ports:
-      - "5000:8080"
+    restart: always
     environment:
-      ASPNETCORE_ENVIRONMENT: Development
-      ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=iled;Username=iled;Password=iled123"
+      ASPNETCORE_ENVIRONMENT: Production
+      ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-iled};Username=${POSTGRES_USER:-iled};Password=${POSTGRES_PASSWORD:-iled123}"
       ConnectionStrings__Redis: "redis:6379"
-      Cors__Origins__0: "http://localhost:4200"
-      Cors__Origins__1: "http://localhost:4201"
+      Cors__Origins__0: "https://shop.zea.lt"
+      Cors__Origins__1: "https://admin.zea.lt"
       OpenTelemetry__OtlpEndpoint: "http://openobserve:5080/api/default"
       OpenTelemetry__OtlpHeaders: "Authorization=Basic cm9vdEBpbGVkLmxvY2FsOkNvbXBsZXhwYXNzIzEyMw=="
       OpenTelemetry__ServiceName: "iled-api"
@@ -62,11 +61,57 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
-      openobserve:
-        condition: service_started
-    profiles:
-      - full
+    networks:
+      - iled
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-api.rule=Host(`api.iled.zea.lt`)"
+      - "traefik.http.routers.iled-api.entrypoints=websecure"
+      - "traefik.http.routers.iled-api.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-api.loadbalancer.server.port=8080"
+
+  shop:
+    image: registry.zea.lt/miczek/iled-shop:latest
+    container_name: iled-shop
+    restart: always
+    depends_on:
+      - api
+    networks:
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-shop.rule=Host(`shop.zea.lt`)"
+      - "traefik.http.routers.iled-shop.entrypoints=websecure"
+      - "traefik.http.routers.iled-shop.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-shop.loadbalancer.server.port=80"
+
+  admin:
+    image: registry.zea.lt/miczek/iled-admin:latest
+    container_name: iled-admin
+    restart: always
+    depends_on:
+      - api
+    networks:
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-admin.rule=Host(`admin.zea.lt`)"
+      - "traefik.http.routers.iled-admin.entrypoints=websecure"
+      - "traefik.http.routers.iled-admin.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-admin.loadbalancer.server.port=80"
 
 volumes:
   iled_pgdata:
   iled_openobserve:
+
+networks:
+  iled:
+    name: iled
+    driver: bridge
+  homelab:
+    name: homelab
+    external: true

docker/nginx-spa.conf

@@ -0,0 +1,15 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
+    expires 7d;
+    add_header Cache-Control "public";
+  }
+}