Move Traefik out of this stack into its own standalone stack

Fixes a circular dependency: a full stack redeploy tears every service down
before bringing any back up, but claude-agent's image pull goes through
Traefik->Gitea's registry. Self-hosting Traefik in the same stack it fronts
means redeploying this stack could tear down the very route needed to bring
it back. Traefik now lives in ~/traefik/docker-compose.yml as shared infra,
independent of this stack's lifecycle.

.env.example

@@ -1,7 +1,8 @@
 # Copy to .env and fill in. Never commit the real .env.
+# Note: ACME_EMAIL / Traefik itself are configured separately in ~/traefik/.env —
+# Traefik is shared infra, not part of this stack (see docker-compose.yml comment).
 
 # --- domain / TLS ---
-ACME_EMAIL=you@example.com
 MATRIX_SERVER_NAME=matrix.apps.williamturner.eu
 AGENT_HOSTNAME=agent.apps.williamturner.eu
 # Set to true ONLY for the first-boot window while creating the bot account,
@@ -13,7 +14,7 @@ GITEA_URL=https://gitea.apps.williamturner.eu
 GITEA_TOKEN=
 GITEA_WEBHOOK_SECRET=
 # Image the agent runs from — built and pushed by .gitea/workflows/build.yml
-GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/claude-agent:latest
+GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/<repo-name>/claude-agent:latest
 
 # --- anthropic ---
 ANTHROPIC_API_KEY=

act-runner-config.yaml

@@ -1,6 +1,4 @@
-# Mounts the host Docker socket into every job container act_runner creates, so
+# act_runner auto-detects that it has its own /var/run/docker.sock mounted (see
-# `docker build`/`docker push` work inside workflow steps (Docker-outside-of-Docker).
+# docker-compose.yml) and passes it through to job containers itself — no explicit
-# This is a runner-admin-controlled default (not something a workflow author can
+# options needed here. This file is kept (even near-empty) so CONFIG_FILE has a
-# request itself), which is the safer of the two ways act_runner supports this.
+# stable target if runner-level settings are needed later.
-container:
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"

docker-compose.yml

@@ -1,35 +1,11 @@
 services:
-  traefik:
+  # Traefik deliberately does NOT live in this stack — it's shared infra fronting
-    # Must be >=3.6 — Docker 29 raised its minimum API version to 1.44, and Traefik's
+  # Gitea/Portainer/Matrix/agent (see ~/traefik/docker-compose.yml, a separate,
-    # Docker provider only gained version auto-negotiation in v3.6.
+  # independently-managed stack). It used to be a service here, but a GitOps redeploy
-    image: traefik:v3.6
+  # tears every service in a stack down before bringing them back up — and claude-agent's
-    container_name: traefik
+  # image pull goes through Traefik→Gitea's registry, so a self-hosted Traefik ends up
-    restart: unless-stopped
+  # briefly tearing down the very route its sibling service needs to come back up.
-    command:
+  # Circular dependency, self-inflicted outage. Don't put Traefik back in this file.
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=web"
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--log.level=INFO"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "traefik_letsencrypt:/letsencrypt"
-    networks:
-      - web
-
-  # Routes for services that live in OTHER compose files (Gitea, Portainer) are added
-  # as labels on those containers directly, not here — see README "Fronting existing
-  # services" section.
 
   matrix-homeserver:
     image: ghcr.io/continuwuity/continuwuity:latest
@@ -110,7 +86,6 @@ networks:
     external: true
 
 volumes:
-  traefik_letsencrypt:
   matrix_data:
   agent_workspace:
   act_runner_data: