Add analoggallery-public stack, update traefik routing

- Add analoggallery-public stack for analog.uplink.tel
- Update uplink.yml: remove routes now handled by Docker labels
  (nitter, freshrss, rsshub, searx, analog)
- Update sequela.yml: remove routes now handled by Docker labels
  (wiki.sequela.tel, matomo.sequela.tel)
- File routes now only contain external proxies (docker-public for
  invidious.uplink.tel, radio.uplink.tel)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/analoggallery-public/docker-compose.yml

@@ -0,0 +1,26 @@
+services:
+  gallery:
+    build:
+      context: https://gitea.ghost.tel/knight/analogGallery.git
+    container_name: analoggallery
+    restart: unless-stopped
+    labels:
+      - "com.ghost.tel/stack-type=public"
+      - "traefik.enable=true"
+      - "traefik.http.routers.analoggallery.entrypoints=https"
+      - "traefik.http.routers.analoggallery.rule=Host(`analog.uplink.tel`)"
+      - "traefik.http.routers.analoggallery.tls.certresolver=http"
+      - "traefik.http.services.analoggallery.loadbalancer.server.port=3000"
+    environment:
+      - NODE_ENV=production
+    volumes:
+      - ./images:/app/images
+      - ./images.json:/app/images.json
+    expose:
+      - "3000"
+    networks:
+      - web
+
+networks:
+  web:
+    external: true

stacks/traefik/conf.d/sequela.yml

@@ -1,33 +1,6 @@
-http:
+# sequela.tel routing
-  routers:
+# All services now run locally via Docker labels:
-    # Wiki.js
+# - wiki.sequela.tel / wiki.sequela.uk -> wikijs-public stack
-    wikijs:
+# - matomo.sequela.tel / matomo.sequela.uk -> matomo-public stack
-      entrypoints:
+#
-        - http
+# This file is kept for reference but contains no active routes.
-        - https
-      rule: "Host(`wiki.sequela.tel`) || Host(`wiki.sequela.uk`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
-    # Matomo Analytics
-    matomo:
-      entrypoints:
-        - http
-        - https
-      rule: "Host(`matomo.sequela.tel`) || Host(`matomo.sequela.uk`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
-  services:
-    docker-public:
-      loadBalancer:
-        passHostHeader: true
-        serversTransport: insecure-transport
-        servers:
-          - url: "https://192.168.5.46:443"
-
-  serversTransports:
-    insecure-transport:
-      insecureSkipVerify: true

stacks/traefik/conf.d/uplink.yml

@@ -1,15 +1,11 @@
+# uplink.tel routing
+# Most services now run locally via Docker labels
+# This file only contains routes that still need external proxying
+
 http:
   routers:
-    # Nitter - Twitter frontend
+    # Invidious on uplink.tel still goes to docker-public
-    nitter:
+    # (local invidious is inv.ghost.tel)
-      entrypoints:
-        - https
-      rule: "Host(`nitter.uplink.tel`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
-    # Invidious - YouTube frontend
     invidious-uplink:
       entrypoints:
         - https
@@ -18,44 +14,18 @@ http:
       tls:
         certResolver: http
 
-    # SearXNG - Search engine
-    searx:
-      entrypoints:
-        - https
-      rule: "Host(`searx.uplink.tel`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
-    # FreshRSS - RSS reader
-    freshrss:
-      entrypoints:
-        - https
-      rule: "Host(`freshrss.uplink.tel`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
-    # RSSHub
-    rsshub:
-      entrypoints:
-        - https
-      rule: "Host(`rsshub.uplink.tel`)"
-      service: docker-public
-      tls:
-        certResolver: http
-
     # Radio (wunder - currently offline)
     radio:
       entrypoints:
         - https
+        - http
       rule: "Host(`radio.uplink.tel`)"
       service: radio-wunder
       tls:
         certResolver: http
 
   services:
-    # Proxy to docker-public's traefik (HTTPS)
+    # Proxy to docker-public's traefik (for invidious.uplink.tel)
     docker-public:
       loadBalancer:
         passHostHeader: true