M1: Traefik swarm stack (wildcard cert via file provider); HTTPS path proven E2E

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -120,3 +120,29 @@ attached to `proxy`. Then abra install + by-hand HTTPS deploy/teardown of a triv
 Rationale for swarm-service Traefik over a host `services.traefik`: a host process isn't on the
 `proxy` overlay, so it can't reach swarm service VIPs; coop-cloud recipes assume an on-`proxy`
 Traefik watching swarm labels.
+
+## 2026-05-26 — M1: Traefik swarm stack + HTTPS path proven
+
+**modules/traefik.nix:** Traefik v3.3 as a swarm service on `proxy` (so it reaches recipe VIPs).
+Config via Nix `writeText` store files bind-mounted into the container (real files, not /etc
+symlinks): static `traefik.yml` (entrypoints web/websecure; `providers.swarm` unix socket,
+exposedByDefault=false, network=proxy; `providers.file` dir /etc/traefik/dynamic; ping; no
+dashboard) and dynamic `certs.yml` (wildcard at /var/lib/ci-certs/live/* as `stores.default.
+defaultCertificate` + certificates — so any *.ci.commoninternet.net router with tls=true is covered,
+no ACME). Deployed by a `traefik-deploy` oneshot (`docker stack deploy`) after swarm-init. Opened
+firewall 80/443 (gateway forwards over enp5s0).
+
+**Build + switch:** build EXIT 0; switch `Result=success`; `traefik-deploy` `Result=success`;
+`docker service ls` → `traefik_traefik traefik:v3.3 1/1`.
+
+**Verify (commands + output):**
+- Local: `curl -ksv -H 'Host: probe-test.ci.commoninternet.net' https://localhost/` →
+  `subject: CN=*.ci.commoninternet.net`, `issuer: …Let's Encrypt; CN=E8`, TLSv1.3, HTTP 404.
+- **End-to-end via gateway:** `curl -ksv --resolve probe-test.ci.commoninternet.net:443:143.244.213.108
+  https://probe-test.ci.commoninternet.net/` → `Connected to …(143.244.213.108) port 443`,
+  same wildcard cert, HTTP 404. Confirms gateway SNI-passthrough → cc-ci Traefik TLS termination.
+  404 is correct (no router for that host yet).
+
+**Next:** install abra (M1 last task), `abra app new` a trivial recipe (custom-html) → deploy →
+reach over HTTPS at <app>.ci.commoninternet.net → teardown leaving no volumes. That completes M1
+→ CLAIM M1 gate.