Document Traefik configuration for TypeType

docs/self-hosting/reverse-proxy.md

@@ -69,6 +69,67 @@ The app uses WebSockets and accepts large uploads (Takeout imports). If you drop
 break. The settings above match what the bundled web container expects.
 :::
 
+## Option C - Traefik
+
+These examples assume an existing Traefik installation with a `websecure`
+entry point listening on port 443 and an
+[ACME certificate resolver](https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/)
+configured in Traefik's static configuration. Replace `YOUR_CERT_RESOLVER` with
+that resolver's name and `watch.example.com` with your domain. Traefik uses the
+resolver to obtain and renew TLS certificates; the snippets below do not create it.
+
+Attach Traefik and the TypeType web service (`typetype`) to the same Docker network.
+The examples use an existing external network named `proxy`; replace that name
+with your Traefik network. Keep the web service on its existing `default` network
+as well so it can still reach the TypeType server.
+
+For Traefik's Docker provider, merge the following into your Compose configuration:
+
+```yaml
+services:
+  typetype:
+    networks:
+      - default
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "proxy"
+      traefik.http.services.typetype.loadbalancer.server.port: "80"
+      traefik.http.routers.typetype.service: "typetype"
+      traefik.http.routers.typetype.entrypoints: "websecure"
+      traefik.http.routers.typetype.rule: "Host(`watch.example.com`)"
+      traefik.http.routers.typetype.tls: "true"
+      traefik.http.routers.typetype.tls.certresolver: "YOUR_CERT_RESOLVER"
+
+networks:
+  proxy:
+    external: true
+```
+
+Alternatively, keep the same network attachments and use this dynamic YAML
+configuration with Traefik's file provider instead of the labels:
+
+```yaml
+http:
+  routers:
+    typetype:
+      entryPoints:
+        - websecure
+      rule: 'Host(`watch.example.com`)'
+      service: typetype
+      tls:
+        certResolver: YOUR_CERT_RESOLVER
+
+  services:
+    typetype:
+      loadBalancer:
+        servers:
+          - url: http://typetype:80
+```
+
+The web container serves plain HTTP on port 80; Traefik terminates HTTPS.
+Enable the Docker or file provider in Traefik according to the example you choose.
+
 ## Remote login and WebSockets
 
 Interactive YouTube login starts with a normal HTTP request, then opens a WebSocket