From ef1567b07129c36b1ba1009c2861b209c9d87fc7 Mon Sep 17 00:00:00 2001
From: latte <latte@hiddenden.cafe>
Date: Sun, 5 Jul 2026 13:38:51 +0200
Subject: [PATCH] chore(deploy): drop Traefik labels, document Pangolin as the
 proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The compose service already joins the external `proxy` network and
exposes :8080; the reverse proxy owns TLS and routing. Remove the
Traefik router labels (and the now-unused FAMILIAR_DOMAIN /
TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers
the service on the shared network — as the proxy instead. nginx/Caddy
guidance is unchanged.
---
 .env.example       |  8 ++++----
 doc/deployment.md  | 15 +++++----------
 docker-compose.yml | 16 +++-------------
 3 files changed, 12 insertions(+), 27 deletions(-)

diff --git a/.env.example b/.env.example
index 96527dc..012ee38 100644
--- a/.env.example
+++ b/.env.example
@@ -40,7 +40,7 @@ FAMILIAR_DATA_DIR_HOST=./data
 # Writes off by default on a public instance. Set true to allow guarded writes.
 FAMILIAR_ENABLE_WRITES=false
 
-# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
-# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
-FAMILIAR_DOMAIN=familiar.example.com
-TRAEFIK_CERTRESOLVER=letsencrypt
+# --- Reverse proxy --------------------------------------------------------- #
+# The container joins the external `proxy` network and exposes :8080; the proxy
+# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
+# to it. The public hostname and certs are configured in the proxy, not here.
diff --git a/doc/deployment.md b/doc/deployment.md
index 74a84bf..92369b9 100644
--- a/doc/deployment.md
+++ b/doc/deployment.md
@@ -77,8 +77,8 @@ Pushing needs a Gitea PAT with `write:package` scope stored as the repo secret `
 
 ```bash
 cp .env.example .env
-# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32), FAMILIAR_DOMAIN,
-#            cert resolver, FAMILIAR_IMAGE (:latest prod / :dev dev channel)
+# edit .env: FAMILIAR_HTTP_TOKEN (openssl rand -hex 32),
+#            FAMILIAR_IMAGE (:latest prod / :dev dev channel)
 
 docker network create proxy    # once, if your reverse proxy doesn't own it yet
 
@@ -121,16 +121,11 @@ familiar.yourdomain.tld {
 
 Caddy fetches and renews the certificate automatically and streams by default.
 
-### Traefik (labels included)
+### Pangolin
 
-`docker-compose.yml` already carries Traefik router labels. Set in `.env`:
+The compose service exposes `:8080` on the shared external `proxy` network and carries no proxy-specific labels. In Pangolin, add a resource for `familiar` that forwards to `http://familiar:8080` (target the container's `/mcp` path), and let Pangolin terminate HTTPS. Make sure Pangolin's own container is attached to the same `proxy` network so it can reach the service by name. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
 
-```
-FAMILIAR_DOMAIN=familiar.yourdomain.tld
-TRAEFIK_CERTRESOLVER=letsencrypt
-```
-
-Traefik terminates HTTPS and forwards to the container's port 8080 on the `proxy` network. Your public URL is then `https://familiar.yourdomain.tld/mcp`.
+Because streamable HTTP holds a long-lived response open, raise the read/response timeout on the familiar resource and disable response buffering if the option is exposed (same reasoning as the nginx `proxy_read_timeout` / `proxy_buffering off` above).
 
 ## Operational notes
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 5318e68..3b852ce 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -60,21 +60,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 10s
-    labels:
-      # --- Traefik TLS termination (Let's Encrypt) -------------------------- #
-      # Enable if your reverse proxy is Traefik on the external `proxy` network.
-      # Set FAMILIAR_DOMAIN and TRAEFIK_CERTRESOLVER in .env. For nginx/Caddy
-      # instead, ignore these labels — see doc/deployment.md.
-      traefik.enable: "true"
-      traefik.docker.network: proxy
-      traefik.http.routers.familiar.rule: Host(`${FAMILIAR_DOMAIN:-familiar.example.com}`)
-      traefik.http.routers.familiar.entrypoints: websecure
-      traefik.http.routers.familiar.tls: "true"
-      traefik.http.routers.familiar.tls.certresolver: ${TRAEFIK_CERTRESOLVER:-letsencrypt}
-      traefik.http.services.familiar.loadbalancer.server.port: "8080"
+    # No proxy labels: Pangolin discovers this service on the shared `proxy`
+    # network and forwards to :8080 — configure the route in Pangolin, not here.
 
 networks:
-  # Shared reverse-proxy network (Traefik/Caddy). Create once with:
+  # Shared reverse-proxy network (Pangolin). Create once with:
   #   docker network create proxy
   proxy:
     external: true
-- 
2.54.0