added nginx to traefik migration changes and docs

docker-compose/traefik/dynamic/dockscope-auth.yml

@@ -0,0 +1,7 @@
+http:
+  middlewares:
+    dockscope-auth:
+      basicAuth:
+        users:
+          # Generate with: htpasswd -nB <username>
+          - "${DOCKSCOPE_AUTH_USER}:${DOCKSCOPE_AUTH_HASH}"

docker-compose/traefik/dynamic/middlewares.yaml

@@ -0,0 +1,17 @@
+http:
+  middlewares:
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+    # Optional but recommended security headers (we can tune later)
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"

docker-compose/traefik/dynamic/pihole.yaml

@@ -0,0 +1,24 @@
+http:
+  routers:
+    pihole:
+      rule: "Host(`pihole.home.server`)"
+      entryPoints:
+        - websecure
+      tls: {}
+      service: pihole
+      middlewares:
+        - security-headers@file
+
+    pihole-http:
+      rule: "Host(`pihole.home.server`)"
+      entryPoints:
+        - web
+      service: pihole          # ← added (required)
+      middlewares:
+        - redirect-to-https@file
+
+  services:
+    pihole:
+      loadBalancer:
+        servers:
+          - url: "http://172.17.0.1:8082"

docker-compose/traefik/dynamic/plex.yml

@@ -0,0 +1,24 @@
+http:
+  routers:
+    plex:
+      rule: "Host(`plex.home.server`)"
+      entryPoints:
+        - websecure
+      tls: {}
+      service: plex
+      middlewares:
+        - security-headers@file
+
+    plex-http:
+      rule: "Host(`plex.home.server`)"
+      entryPoints:
+        - web
+      service: plex
+      middlewares:
+        - redirect-to-https@file
+
+  services:
+    plex:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.100.6:32400"

docker-compose/traefik/dynamic/sentinel.yml

@@ -0,0 +1,24 @@
+http:
+  routers:
+    sentinel:
+      rule: "Host(`sentinel.home.server`)"
+      entryPoints:
+        - websecure
+      tls: true
+      service: sentinel
+      middlewares:
+        - security-headers@file
+
+    sentinel-http:
+      rule: "Host(`sentinel.home.server`)"
+      entryPoints:
+        - web
+      service: sentinel
+      middlewares:
+        - redirect-to-https@file
+
+  services:
+    sentinel:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.100.6:8088"

docker-compose/traefik/dynamic/tls.yaml

@@ -0,0 +1,6 @@
+tls:
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /certs/home.server.crt
+        keyFile: /certs/home.server.key