fix: Traefik Let's Encrypt acme.json

.gitea/workflows/production.yaml

@@ -122,9 +122,14 @@ jobs:
       - name: Initialize data directories
         run: |
           cd "$DEPLOY_PATH"
-          sudo mkdir -p data/backups data/documents
+          sudo mkdir -p data/backups data/documents data/traefik
           sudo chown -R 1001:1001 data/backups data/documents
           sudo chmod 755 data/backups data/documents
+          # Traefik acme.json requires 600 permissions
+          if [ ! -f data/traefik/acme.json ]; then
+            touch data/traefik/acme.json
+          fi
+          chmod 600 data/traefik/acme.json
 
       - name: Pull new images
         run: |

.gitea/workflows/staging.yaml

@@ -114,9 +114,14 @@ jobs:
       - name: Initialize data directories
         run: |
           cd "$DEPLOY_PATH"
-          sudo mkdir -p data/backups data/documents
+          sudo mkdir -p data/backups data/documents data/traefik
           sudo chown -R 1001:1001 data/backups data/documents
           sudo chmod 755 data/backups data/documents
+          # Traefik acme.json requires 600 permissions
+          if [ ! -f data/traefik/acme.json ]; then
+            touch data/traefik/acme.json
+          fi
+          chmod 600 data/traefik/acme.json
 
       - name: Pull new images
         run: |

.gitignore

@@ -17,4 +17,7 @@ coverage/
 secrets/**
 !secrets/
 !secrets/**/
-!secrets/**/*.example
+!secrets/**/*.example
+
+# Traefik ACME certificates (contains private keys)
+data/traefik/acme.json

docker-compose.blue-green.yml

@@ -191,5 +191,5 @@ services:
       - ./config/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./config/traefik/dynamic:/etc/traefik/dynamic:ro
       - ./certs:/certs:ro
-      - traefik_data:/data
+      - ./data/traefik:/data
       - ./secrets/app/cloudflare-dns-token.txt:/run/secrets/cloudflare-dns-token:ro

docker-compose.yml

@@ -21,7 +21,7 @@ services:
       - ./config/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./config/traefik/dynamic:/etc/traefik/dynamic:ro
       - ./certs:/certs:ro
-      - traefik_data:/data
+      - ./data/traefik:/data
       - ./secrets/app/cloudflare-dns-token.txt:/run/secrets/cloudflare-dns-token:ro
     networks:
       frontend:
@@ -233,7 +233,6 @@ networks:
 
 # Volume Definitions
 volumes:
-  traefik_data: null
   mvp_postgres_data:
     name: mvp_postgres_data
   mvp_redis_data: