docker compose - backend+traefik

# Unified Docker Compose file for Hackalyst (Traefik + Backend)

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      # Use staging Let's Encrypt server for development to avoid rate limits
      - ACME_CA_SERVER=https://acme-staging-v02.api.letsencrypt.org/directory
      # Hardcoded for local development
      - TRAEFIK_DASHBOARD_CRED=user:pass (removed real value for pastebin)
    ports:
      - "80:80"
      - "443:443"
      - "8081:8080" # Dashboard port for development (changed to 8081 to avoid conflicts)
    volumes:
      - ./backend/infra/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./backend/infra/traefik/dynamic:/etc/traefik/dynamic:ro
      - ./backend/infra/traefik/acme/acme.json:/acme/acme.json
      - /var/run/docker.sock:/var/run/docker.sock:ro # For Docker provider to work
    networks:
      - proxy
    command:
      - "--providers.docker.exposedbydefault=false"
      - "--api.insecure=true" # Allow insecure access to dashboard in development
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard-local.rule=Host(`localhost`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.dashboard-local.service=api@internal"
      - "traefik.http.routers.dashboard-local.entrypoints=dashboard"

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: hackalyst-backend
    container_name: hackalyst-backend
    restart: unless-stopped
    environment:
      - NODE_ENV=development
      - MONGODB_URI=mongodb://localhost:27017/hackalyst
      - CLERK_JWKS_PUBLIC_KEY=dummy_key
      # Uncomment these for production with Infisical
      # - INFISICAL_MACHINE_IDENTITY_ID=${INFISICAL_MACHINE_IDENTITY_ID}
      # - INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET=${INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET}
      # - INFISICAL_PROJECT_ID=${INFISICAL_PROJECT_ID}
    volumes:
      - ./backend:/root/app
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.backend.rule=Host(`backend.hackalyst.com`)"
      - "traefik.http.routers.backend.entrypoints=websecure"
      - "traefik.http.routers.backend.tls.certresolver=letsencrypt"
      - "traefik.http.services.backend.loadbalancer.server.port=3000"
      # For local non-TLS access
      - "traefik.http.routers.backend-insecure.rule=Host(`backend.hackalyst.com`)"
      - "traefik.http.routers.backend-insecure.entrypoints=web"

networks:
  proxy:
    name: proxy
    external: true # Use an existing network