deploy: Traefik hosts + registry images for shop/admin/api

Publish nginx/API images from CI and deploy on the Pi with
shop.zea.lt, admin.zea.lt, and api.iled.zea.lt.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -1,5 +1,4 @@
-# Drone CI/CD for iLED shop
-# Builds run on the Windows desktop agent (linux/amd64). Pi only hosts Drone.
+# Drone CI/CD for iLED shop — build on desktop agent, deploy to Pi via SSH.
 
 kind: pipeline
 type: docker
@@ -58,6 +57,60 @@ steps:
     depends_on:
       - api
 
+  - name: docker-api
+    image: plugins/docker
+    pull: false
+    settings:
+      repo: registry.zea.lt/miczek/iled-api
+      registry: registry.zea.lt
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
+      dockerfile: docker/Dockerfile.api
+      context: .
+      tags:
+        - latest
+        - ${DRONE_COMMIT_SHA:0:7}
+    depends_on:
+      - api
+
+  - name: docker-shop
+    image: plugins/docker
+    pull: false
+    settings:
+      repo: registry.zea.lt/miczek/iled-shop
+      registry: registry.zea.lt
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
+      dockerfile: docker/Dockerfile.shop
+      context: .
+      tags:
+        - latest
+        - ${DRONE_COMMIT_SHA:0:7}
+    depends_on:
+      - shop
+
+  - name: docker-admin
+    image: plugins/docker
+    pull: false
+    settings:
+      repo: registry.zea.lt/miczek/iled-admin
+      registry: registry.zea.lt
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
+      dockerfile: docker/Dockerfile.admin
+      context: .
+      tags:
+        - latest
+        - ${DRONE_COMMIT_SHA:0:7}
+    depends_on:
+      - admin
+
 trigger:
   event:
     - push
@@ -101,18 +154,27 @@ steps:
       script_stop: true
       envs:
         - DEPLOY_PATH
+        - REGISTRY_USERNAME
+        - REGISTRY_PASSWORD
       script:
         - set -euo pipefail
+        - DEPLOY_PATH="${DEPLOY_PATH:-/opt/iled-shop}"
         - cd "${DEPLOY_PATH}"
         - git fetch origin
         - git checkout "${DRONE_COMMIT_SHA}"
+        - echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
         - cd docker
-        - docker compose --profile full pull || true
-        - docker compose --profile full up -d --build --remove-orphans
-        - docker compose --profile full ps
+        - docker compose pull
+        - docker compose up -d --remove-orphans
+        - docker compose ps
+        - docker logout registry.zea.lt || true
     environment:
       DEPLOY_PATH:
         from_secret: deploy_path
+      REGISTRY_USERNAME:
+        from_secret: registry_username
+      REGISTRY_PASSWORD:
+        from_secret: registry_password
 
 trigger:
   branch:
@@ -120,3 +182,4 @@ trigger:
     - main
   event:
     - push
+    - custom

docker/Dockerfile.admin

@@ -0,0 +1,4 @@
+FROM nginx:1.27-alpine
+COPY src/admin/dist/admin/browser /usr/share/nginx/html
+COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80

docker/Dockerfile.api

@@ -1,7 +1,7 @@
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src
-COPY . .
-RUN dotnet restore iLED.sln
+COPY src/backend/ .
+RUN dotnet restore iLED.slnx
 RUN dotnet publish src/iLED.Api/iLED.Api.csproj -c Release -o /app/publish
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0

docker/Dockerfile.shop

@@ -0,0 +1,4 @@
+FROM nginx:1.27-alpine
+COPY src/shop/dist/shop/browser /usr/share/nginx/html
+COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80

docker/docker-compose.yml

@@ -2,58 +2,57 @@ services:
   postgres:
     image: postgres:16-alpine
     container_name: iled-postgres
+    restart: always
     environment:
-      POSTGRES_DB: iled
-      POSTGRES_USER: iled
-      POSTGRES_PASSWORD: iled123
-    ports:
-      - "5433:5432"
+      POSTGRES_DB: ${POSTGRES_DB:-iled}
+      POSTGRES_USER: ${POSTGRES_USER:-iled}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-iled123}
     volumes:
       - iled_pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U iled -d iled"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - iled
+      - homelab
 
   redis:
     image: redis:7-alpine
     container_name: iled-redis
-    ports:
-      - "6379:6379"
+    restart: always
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - iled
 
-  # Backend observability: logs + metrics + traces (UI http://localhost:5080)
-  # Login: root@iled.local / Complexpass#123
   openobserve:
     image: public.ecr.aws/zinclabs/openobserve:latest
     container_name: iled-openobserve
+    restart: always
     environment:
-      ZO_ROOT_USER_EMAIL: root@iled.local
-      ZO_ROOT_USER_PASSWORD: Complexpass#123
+      ZO_ROOT_USER_EMAIL: ${ZO_ROOT_USER_EMAIL:-root@iled.local}
+      ZO_ROOT_USER_PASSWORD: ${ZO_ROOT_USER_PASSWORD:-Complexpass#123}
       ZO_DATA_DIR: /data
-    ports:
-      - "5080:5080"
     volumes:
       - iled_openobserve:/data
+    networks:
+      - iled
 
   api:
-    build:
-      context: ../src/backend
-      dockerfile: ../../docker/Dockerfile.api
+    image: registry.zea.lt/miczek/iled-api:latest
     container_name: iled-api
-    ports:
-      - "5000:8080"
+    restart: always
     environment:
-      ASPNETCORE_ENVIRONMENT: Development
-      ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=iled;Username=iled;Password=iled123"
+      ASPNETCORE_ENVIRONMENT: Production
+      ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-iled};Username=${POSTGRES_USER:-iled};Password=${POSTGRES_PASSWORD:-iled123}"
       ConnectionStrings__Redis: "redis:6379"
-      Cors__Origins__0: "http://localhost:4200"
-      Cors__Origins__1: "http://localhost:4201"
+      Cors__Origins__0: "https://shop.zea.lt"
+      Cors__Origins__1: "https://admin.zea.lt"
       OpenTelemetry__OtlpEndpoint: "http://openobserve:5080/api/default"
       OpenTelemetry__OtlpHeaders: "Authorization=Basic cm9vdEBpbGVkLmxvY2FsOkNvbXBsZXhwYXNzIzEyMw=="
       OpenTelemetry__ServiceName: "iled-api"
@@ -62,11 +61,57 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
-      openobserve:
-        condition: service_started
-    profiles:
-      - full
+    networks:
+      - iled
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-api.rule=Host(`api.iled.zea.lt`)"
+      - "traefik.http.routers.iled-api.entrypoints=websecure"
+      - "traefik.http.routers.iled-api.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-api.loadbalancer.server.port=8080"
+
+  shop:
+    image: registry.zea.lt/miczek/iled-shop:latest
+    container_name: iled-shop
+    restart: always
+    depends_on:
+      - api
+    networks:
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-shop.rule=Host(`shop.zea.lt`)"
+      - "traefik.http.routers.iled-shop.entrypoints=websecure"
+      - "traefik.http.routers.iled-shop.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-shop.loadbalancer.server.port=80"
+
+  admin:
+    image: registry.zea.lt/miczek/iled-admin:latest
+    container_name: iled-admin
+    restart: always
+    depends_on:
+      - api
+    networks:
+      - homelab
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=homelab"
+      - "traefik.http.routers.iled-admin.rule=Host(`admin.zea.lt`)"
+      - "traefik.http.routers.iled-admin.entrypoints=websecure"
+      - "traefik.http.routers.iled-admin.tls.certresolver=leresolver"
+      - "traefik.http.services.iled-admin.loadbalancer.server.port=80"
 
 volumes:
   iled_pgdata:
   iled_openobserve:
+
+networks:
+  iled:
+    name: iled
+    driver: bridge
+  homelab:
+    name: homelab
+    external: true

docker/nginx-spa.conf

@@ -0,0 +1,15 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
+    expires 7d;
+    add_header Cache-Control "public";
+  }
+}