feat: launch desfoto.de as a standalone photography site and retire the old redirect

compose.vps.yml

@@ -0,0 +1,38 @@
+# VPS overlay: attaches the static web service to the shared Traefik network.
+# Applied together with compose.yml on the production host:
+#   docker compose -f compose.yml -f compose.vps.yml up -d
+services:
+  web:
+    labels:
+      traefik.enable: 'true'
+      traefik.docker.network: web
+
+      # HTTPS routers -------------------------------------------------------
+      traefik.http.routers.desfoto.rule: Host(`desfoto.de`)
+      traefik.http.routers.desfoto.entrypoints: https
+      traefik.http.routers.desfoto.tls.certresolver: le
+      traefik.http.routers.desfoto.priority: '200'
+      traefik.http.routers.desfoto.service: desfoto
+
+      traefik.http.routers.desfoto-www.rule: Host(`www.desfoto.de`)
+      traefik.http.routers.desfoto-www.entrypoints: https
+      traefik.http.routers.desfoto-www.tls.certresolver: le
+      traefik.http.routers.desfoto-www.priority: '200'
+      traefik.http.routers.desfoto-www.middlewares: desfoto-canonical
+      traefik.http.routers.desfoto-www.service: desfoto
+
+      # HTTP is already redirected to HTTPS by the global Traefik entrypoint
+      # redirection (see /srv/stack/docker-compose.yml); the ACME http-challenge
+      # is answered by Traefik itself before the redirect.
+      traefik.http.middlewares.desfoto-canonical.redirectregex.regex: ^https?://(?:www\.)?desfoto\.de/(.*)
+      traefik.http.middlewares.desfoto-canonical.redirectregex.replacement: https://desfoto.de/$${1}
+      traefik.http.middlewares.desfoto-canonical.redirectregex.permanent: 'true'
+
+      traefik.http.services.desfoto.loadbalancer.server.port: '80'
+    networks:
+      - default
+      - web
+
+networks:
+  web:
+    external: true