chore: add traefik deployment and config generation

roles/reverseproxy/templates/docker-compose.yml.j2

@@ -0,0 +1,23 @@
+version: '3.8'
+
+services:
+  traefik:
+    image: traefik:v3.5
+    container_name: traefik
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+{% if enable_dashboard %}
+      - "8080:8080"  # Dashboard
+{% endif %}
+    volumes:
+      - {{ docker_volume_dir }}/traefik/etc/traefik:/etc/traefik:ro
+      - {{ docker_volume_dir }}/traefik/letsencrypt:/letsencrypt
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - traefik
+
+networks:
+  traefik:
+    external: true

roles/reverseproxy/templates/services.yml.j2

@@ -0,0 +1,30 @@
+{% if use_static_services | default(false) %}
+http:
+  routers:
+{% for service in all_services %}
+    {{ service.name }}:
+      rule: "Host(`{{ service.domain }}`)"
+      service: {{ service.name }}-service
+      entryPoints:
+{% if use_ssl | default(false) %}
+        - websecure
+      tls:
+        certResolver: letsencrypt
+{% else %}
+        - web
+{% endif %}
+{% endfor %}
+
+  services:
+{% for service in all_services %}
+    {{ service.name }}-service:
+      loadBalancer:
+        servers:
+          - url: "{{ service.upstream_protocol }}://{{ service.backend_host }}:{{ service.port }}"
+{% if service.health_check is defined %}
+        healthCheck:
+          path: "{{ service.health_check }}"
+          interval: "30s"
+{% endif %}
+{% endfor %}
+{% endif %}

roles/reverseproxy/templates/traefik.yml.j2

@@ -0,0 +1,42 @@
+{% if enable_dashboard %}
+api:
+  dashboard: true
+  insecure: true
+{% endif %}
+
+entryPoints:
+  web:
+    address: ":80"
+{% if use_ssl %}
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+{% endif %}
+  websecure:
+    address: ":443"
+
+providers:
+{% if use_static_services | default(false) %}
+  file:
+    filename: /etc/traefik/services.yml
+    watch: true
+{% endif %}
+{% if use_docker_provider | default(true) %}
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+{% endif %}
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@digitalboard.ch
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+
+global:
+  checkNewVersion: false
+  sendAnonymousUsage: false