chore(deploy): drop Traefik labels, document Pangolin as the proxy

The compose service already joins the external `proxy` network and
exposes :8080; the reverse proxy owns TLS and routing. Remove the
Traefik router labels (and the now-unused FAMILIAR_DOMAIN /
TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers
the service on the shared network — as the proxy instead. nginx/Caddy
guidance is unchanged.

.env.example

@@ -40,7 +40,7 @@ FAMILIAR_DATA_DIR_HOST=./data
 # Writes off by default on a public instance. Set true to allow guarded writes.
 FAMILIAR_ENABLE_WRITES=false
 
-# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
+# --- Reverse proxy --------------------------------------------------------- #
-# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
+# The container joins the external `proxy` network and exposes :8080; the proxy
-FAMILIAR_DOMAIN=familiar.example.com
+# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
-TRAEFIK_CERTRESOLVER=letsencrypt
+# to it. The public hostname and certs are configured in the proxy, not here.

doc/deployment.md

@@ -77,8 +77,8 @@ Pushing needs a Gitea PAT with `write:package` scope stored as the repo secret `
 
 ```bash
 cp .env.example .env
-# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32), FAMILIAR_DOMAIN,
+# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32),
-#            cert resolver, FAMILIAR_IMAGE (:latest prod / :dev dev channel)
+#            FAMILIAR_IMAGE (:latest prod / :dev dev channel)
 
 docker network create proxy    # once, if your reverse proxy doesn't own it yet
 
@@ -121,16 +121,11 @@ familiar.yourdomain.tld {
 
 Caddy fetches and renews the certificate automatically and streams by default.
 
-### Traefik (labels included)
+### Pangolin
 
-`docker-compose.yml` already carries Traefik router labels. Set in `.env`:
+The compose service exposes `:8080` on the shared external `proxy` network and carries no proxy-specific labels. In Pangolin, add a resource for `familiar` that forwards to `http://familiar:8080` (target the container's `/mcp` path), and let Pangolin terminate HTTPS. Make sure Pangolin's own container is attached to the same `proxy` network so it can reach the service by name. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
 
-```
+Because streamable HTTP holds a long-lived response open, raise the read/response timeout on the familiar resource and disable response buffering if the option is exposed (same reasoning as the nginx `proxy_read_timeout` / `proxy_buffering off` above).
-FAMILIAR_DOMAIN=familiar.yourdomain.tld
-TRAEFIK_CERTRESOLVER=letsencrypt
-```
-
-Traefik terminates HTTPS and forwards to the container's port 8080 on the `proxy` network. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
 
 ## Operational notes
 

docker-compose.yml

@@ -60,21 +60,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 10s
-    labels:
+    # No proxy labels: Pangolin discovers this service on the shared `proxy`
-      # --- Traefik TLS termination (Let's Encrypt) -------------------------- #
+    # network and forwards to :8080 — configure the route in Pangolin, not here.
-      # Enable if your reverse proxy is Traefik on the external `proxy` network.
-      # Set FAMILIAR_DOMAIN and TRAEFIK_CERTRESOLVER in .env. For nginx/Caddy
-      # instead, ignore these labels — see doc/deployment.md.
-      traefik.enable: "true"
-      traefik.docker.network: proxy
-      traefik.http.routers.familiar.rule: Host(`${FAMILIAR_DOMAIN:-familiar.example.com}`)
-      traefik.http.routers.familiar.entrypoints: websecure
-      traefik.http.routers.familiar.tls: "true"
-      traefik.http.routers.familiar.tls.certresolver: ${TRAEFIK_CERTRESOLVER:-letsencrypt}
-      traefik.http.services.familiar.loadbalancer.server.port: "8080"
 
 networks:
-  # Shared reverse-proxy network (Traefik/Caddy). Create once with:
+  # Shared reverse-proxy network (Pangolin). Create once with:
   #   docker network create proxy
   proxy:
     external: true