implemented compose by url, parse, local yaml.

host_vars/.gitignore

@@ -0,0 +1 @@
+*internal.yml

host_vars/cloud.internal.yml.example

@@ -1,29 +0,0 @@
----
-nbops_hostname: cloud
-nbops_fqdn: cloud.example.internal
-nbops_roles:
-  - base
-  - ssh
-  - ufw
-  - updates
-  - docker
-  - mtls
-  - monitoring
-  - traefik
-  - ocis
-
-nbops_service_routing_mode: traefik
-nbops_traefik_entrypoint: web
-nbops_traefik_tls: false
-
-# Bind this to the VM's internal/LAN address in production.
-traefik_bind_address: "0.0.0.0"
-traefik_publish_entrypoints: true
-traefik_domain: apps-01.example.internal
-traefik_forwarded_headers_trusted_ips:
-  - 10.0.0.0/8
-  - 172.16.0.0/12
-  - 192.168.0.0/16
-
-ocis_url: https://files.example.internal
-

host_vars/edge.yml.example

@@ -1,31 +0,0 @@
----
-nbops_hostname: edge
-nbops_fqdn: edge.example.invalid
-nbops_roles:
-  - base
-  - ssh
-  - ufw
-  - updates
-  - docker
-  - mtls
-  - monitoring
-  - traefik
-  - authentik
-  - authentik_rac
-  - authentik_ldap
-  - authentik_worker
-
-nbops_service_routing_mode: traefik
-nbops_service_domain_suffix: example.invalid
-nbops_traefik_entrypoint: websecure
-nbops_traefik_tls: true
-
-traefik_bind_address: "0.0.0.0"
-traefik_publish_entrypoints: true
-traefik_domain: example.invalid
-traefik_acme_email: admin@example.invalid
-
-authentik_domain: auth.example.invalid
-authentik_http_port: 9000
-authentik_https_port: 9443
-

host_vars/generic-downstream.yml.example

@@ -19,8 +19,21 @@ nbops_service_routing_mode: traefik
 nbops_traefik_entrypoint: web
 nbops_traefik_tls: false
 
+# Edge Traefik consumes these file-provider routes and forwards to this VM's
+# internal Traefik. Internal Traefik still discovers application containers
+# through Docker labels.
+nbops_traefik_file_routes:
+  - name: gitea
+    domain: git.example.internal
+    scheme: http
+    port: 80
+  - name: immich
+    domain: photos.example.internal
+    scheme: http
+    port: 80
+
 # Bind this to the VM's internal/LAN address in production.
-traefik_bind_address: "0.0.0.0"
+traefik_bind_address: "10.0.10.25"
 traefik_publish_entrypoints: true
 traefik_domain: apps-01.example.internal
 traefik_forwarded_headers_trusted_ips:
@@ -54,4 +67,3 @@ arr_services:
     image: lscr.io/linuxserver/bazarr:latest
     port: 6767
     domain: bazarr.example.internal
-

host_vars/pelican-server.yml.example

@@ -1,15 +0,0 @@
----
-nbops_hostname: pelican-node-01
-nbops_fqdn: pelican-node-01.example.internal
-nbops_roles:
-  - base
-  - ssh
-  - ufw
-  - updates
-  - docker
-  - pelican_server
-
-pelican_server_daemon_port: 8080
-pelican_server_sftp_port: 2022
-pelican_server_allocation_ports:
-  - { port: "25565:25575", proto: tcp }

host_vars/wings.internal.example

@@ -1,29 +0,0 @@
----
-nbops_hostname: cloud
-nbops_fqdn: cloud.example.internal
-nbops_roles:
-  - base
-  - ssh
-  - ufw
-  - updates
-  - docker
-  - mtls
-  - monitoring
-  - traefik
-  - ocis
-
-nbops_service_routing_mode: traefik
-nbops_traefik_entrypoint: web
-nbops_traefik_tls: false
-
-# Bind this to the VM's internal/LAN address in production.
-traefik_bind_address: "0.0.0.0"
-traefik_publish_entrypoints: true
-traefik_domain: apps-01.example.internal
-traefik_forwarded_headers_trusted_ips:
-  - 10.0.0.0/8
-  - 172.16.0.0/12
-  - 192.168.0.0/16
-
-ocis_url: https://files.example.internal
-