Initial commit: ElysiaJS backend + TanStack Start frontend + Traefik compose

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,56 @@
+# test-app-stack — frontend (TanStack Start) + backend (ElysiaJS/Bun)
+# Designed to plug into the EXISTING Traefik instance already running on the
+# VPS (the one from forgejo-stack). It therefore reuses the external `web`
+# network and the `le` Let's Encrypt cert resolver. No Traefik service is
+# defined here on purpose.
+
+services:
+  backend:
+    build: ./backend
+    container_name: test-app-backend
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+      - FRONTEND_ORIGIN=${FRONTEND_ORIGIN:-https://test-app.emmanuelariasa.com}
+    networks:
+      - web
+      - app-internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=web"
+      - "traefik.http.routers.testapp-api.rule=Host(`${API_DOMAIN:-test-app-api.emmanuelariasa.com}`)"
+      - "traefik.http.routers.testapp-api.entrypoints=websecure"
+      - "traefik.http.routers.testapp-api.tls.certresolver=le"
+      - "traefik.http.services.testapp-api.loadbalancer.server.port=3000"
+
+  frontend:
+    build:
+      context: ./frontend
+      args:
+        # Baked into the client bundle at build time.
+        VITE_API_URL: "https://${API_DOMAIN:-test-app-api.emmanuelariasa.com}"
+    container_name: test-app-frontend
+    restart: unless-stopped
+    depends_on:
+      - backend
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+    networks:
+      - web
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=web"
+      - "traefik.http.routers.testapp.rule=Host(`${APP_DOMAIN:-test-app.emmanuelariasa.com}`)"
+      - "traefik.http.routers.testapp.entrypoints=websecure"
+      - "traefik.http.routers.testapp.tls.certresolver=le"
+      - "traefik.http.services.testapp.loadbalancer.server.port=3000"
+
+networks:
+  # Shared with Traefik + forgejo. Created already by the forgejo stack.
+  web:
+    external: true
+  # Private network for any future backend<->db traffic; not exposed.
+  app-internal:
+    driver: bridge