deploy(prod): swap host Caddy for NetBird-Traefik labels + external Keycloak

Ambrosio's TLS is now handled by the Traefik that NetBird's self-hosted
installer deploys. kong + app attach to that Traefik network and expose
themselves via Docker-provider labels (erosi-kong priority 100 for
Supabase API paths, erosi-app priority 1 for everything else on
erosi.limonia.net). No container publishes host ports; host Caddy is
out of the deploy path permanently.

Keycloak is no longer bundled — PUBLIC_KEYCLOAK_URL points at an
external IdP. The deploy script writes .env with FILL_IN_* placeholders
for PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET, and TRAEFIK_NETWORK,
and fails fast until they are filled.

New domain: erosi.limonia.net. realm-export.erosi.json is retained
as reference for the external Keycloak operator; it is no longer
imported by this stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infra/docker-compose.erosi.yml

@@ -1,11 +1,13 @@
 name: colectivo-erosi
 
-# Production stack for ambrosio (OVH VPS).
-# Domains: erosi.oier.ovh (app + Supabase API) | auth.oier.ovh (Keycloak)
+# Production stack for ambrosio.
+# Domain: erosi.limonia.net (app + Supabase API, single-domain).
+# Keycloak: external — URL set via PUBLIC_KEYCLOAK_URL in .env.
 #
-# TLS + reverse proxy is handled by the HOST Caddy (systemd service on ambrosio,
-# config at /etc/caddy/Caddyfile) — NOT by a container. All services here bind
-# to 127.0.0.1 so only Caddy can reach them.
+# TLS + reverse proxy is handled by Traefik (deployed by NetBird's self-hosted
+# installer on ambrosio). `kong` and `app` attach to Traefik's Docker network
+# (name in ${TRAEFIK_NETWORK}) and expose themselves via traefik.* labels.
+# No container binds a host port.
 #
 # Bring up:    docker compose -f infra/docker-compose.erosi.yml --env-file .env up -d --build
 # Logs:        docker compose -f infra/docker-compose.erosi.yml logs -f
@@ -54,8 +56,7 @@ services:
       GOTRUE_EXTERNAL_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
       GOTRUE_EXTERNAL_KEYCLOAK_SECRET: ${KEYCLOAK_CLIENT_SECRET}
       GOTRUE_EXTERNAL_KEYCLOAK_SCOPES: "openid profile email"
-      # Public Keycloak base URL (browser sees this). The `/realms/colectivo`
-      # suffix is appended by GoTrue.
+      # Browser-facing Keycloak issuer URL. GoTrue appends /.well-known to it.
       GOTRUE_EXTERNAL_KEYCLOAK_URL: ${PUBLIC_KEYCLOAK_URL}/realms/${PUBLIC_KEYCLOAK_REALM}
       GOTRUE_EXTERNAL_KEYCLOAK_REDIRECT_URI: ${PUBLIC_SUPABASE_URL}/auth/v1/callback
       GOTRUE_MAILER_AUTOCONFIRM: "true"
@@ -142,13 +143,11 @@ services:
       - storage-data:/var/lib/storage:ro
     networks: [colectivo]
 
-  # ── Kong (API Gateway) — bound to localhost only; host Caddy proxies it ────
+  # ── Kong (API Gateway) — exposed on the Traefik network via labels ────────
   kong:
     image: kong:2.8.1
     restart: always
     entrypoint: ["/bin/bash", "/home/kong/kong-start.sh"]
-    ports:
-      - "127.0.0.1:8000:8000"
     depends_on:
       db: { condition: service_healthy }
     environment:
@@ -163,39 +162,15 @@ services:
     volumes:
       - ./kong.yml:/home/kong/temp.yml:ro
       - ./kong-start.sh:/home/kong/kong-start.sh:ro
-    networks: [colectivo]
-
-  # ── Keycloak 24 ────────────────────────────────────────────────────────────
-  # Bound to localhost only; host Caddy proxies auth.oier.ovh → 127.0.0.1:8090.
-  # KC_PROXY=edge expects X-Forwarded-* from Caddy.
-  keycloak:
-    image: quay.io/keycloak/keycloak:24.0.5
-    restart: always
-    ports:
-      - "127.0.0.1:8090:8080"
-    # Plain `start` (no --optimized) so Quarkus re-builds with the Postgres
-    # driver on first boot. --optimized skips the build phase and falls back
-    # to H2, producing "URL format error ... jdbc:h2" on startup.
-    command: start --import-realm
-    depends_on:
-      db: { condition: service_healthy }
-    environment:
-      KC_DB: postgres
-      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
-      KC_DB_USERNAME: keycloak
-      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
-      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
-      KC_HOSTNAME_STRICT: "true"
-      KC_HOSTNAME_STRICT_HTTPS: "true"
-      KC_PROXY: edge
-      KC_HTTP_ENABLED: "true"
-      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
-      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
-      KC_FEATURES: token-exchange
-    volumes:
-      - keycloak-data:/opt/keycloak/data
-      - ../keycloak/realm-export.erosi.json:/opt/keycloak/data/import/realm-export.json:ro
-    networks: [colectivo]
+    networks: [colectivo, traefik]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${TRAEFIK_NETWORK}"
+      - "traefik.http.routers.erosi-kong.rule=Host(`erosi.limonia.net`) && (PathPrefix(`/rest/v1`) || PathPrefix(`/auth/v1`) || PathPrefix(`/realtime/v1`) || PathPrefix(`/storage/v1`) || PathPrefix(`/graphql/v1`) || PathPrefix(`/pg`))"
+      - "traefik.http.routers.erosi-kong.entrypoints=${TRAEFIK_ENTRYPOINT}"
+      - "traefik.http.routers.erosi-kong.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
+      - "traefik.http.routers.erosi-kong.priority=100"
+      - "traefik.http.services.erosi-kong.loadbalancer.server.port=8000"
 
   # ── App (SvelteKit Node server) — built on the host from the repo ──────────
   # Build args bake the PUBLIC_* values into the client bundle (SvelteKit reqs).
@@ -212,8 +187,6 @@ services:
         PUBLIC_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
         PUBLIC_APP_URL: ${PUBLIC_APP_URL}
     restart: always
-    ports:
-      - "127.0.0.1:3000:3000"
     environment:
       PUBLIC_SUPABASE_URL: ${PUBLIC_SUPABASE_URL}
       PUBLIC_SUPABASE_ANON_KEY: ${PUBLIC_SUPABASE_ANON_KEY}
@@ -222,13 +195,23 @@ services:
       PUBLIC_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
       PUBLIC_APP_URL: ${PUBLIC_APP_URL}
       NODE_ENV: production
-    networks: [colectivo]
+    networks: [colectivo, traefik]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${TRAEFIK_NETWORK}"
+      - "traefik.http.routers.erosi-app.rule=Host(`erosi.limonia.net`)"
+      - "traefik.http.routers.erosi-app.entrypoints=${TRAEFIK_ENTRYPOINT}"
+      - "traefik.http.routers.erosi-app.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
+      - "traefik.http.routers.erosi-app.priority=1"
+      - "traefik.http.services.erosi-app.loadbalancer.server.port=3000"
 
 networks:
   colectivo:
     driver: bridge
+  traefik:
+    name: ${TRAEFIK_NETWORK}
+    external: true
 
 volumes:
   db-data:
   storage-data:
-  keycloak-data: