feat(P1): orca-traefik container image + release pipeline (REQ-171)

Dockerfile.traefik: extends traefik:v3.3.0 with baked default
static config (entrypoints 127.0.0.1:8080/8443/8081, file provider
watching /etc/traefik/dynamic, json log). Host-side traefik.yml
mounted :ro at runtime to override baked default (preserves
traefik-on-public-ip opt-out, REQ-100, C-58).

No certificatesResolvers — traefik v3.3 only supports acme/tailscale
(research finding). tls: {} in dynamic config for v0.14; real mTLS
deferred to v0.15 (grill G-003, confidence 0.55 < 0.60).

release.sh: second docker block builds+pushes orca-traefik image.
.coreci.yml: container-publish-traefik step mirrors container-publish.

Verified: docker build -f Dockerfile.traefik . succeeds; image starts
traefik v3.3.0 with --configFile=/etc/traefik/traefik.yml.

---ci---
project: orca
phase: 1
milestone: v0.14
status: execute
---/ci---

.coreci.yml

@@ -167,3 +167,19 @@ pipelines:
           - docker push git.cloudinit.dev/coreci/orca:${VERSION}
           - docker push git.cloudinit.dev/coreci/orca:latest
           - docker logout git.cloudinit.dev
+      - name: container-publish-traefik
+        description: Build and publish orca-traefik OCI image (REQ-171, R-024)
+        image: docker:24-cli
+        env:
+          GITEA_TOKEN: ${GITEA_TOKEN}
+          VERSION: ${CI_COMMIT_TAG}
+        commands:
+          - docker build
+              -f Dockerfile.traefik
+              -t git.cloudinit.dev/coreci/orca-traefik:${VERSION}
+              -t git.cloudinit.dev/coreci/orca-traefik:latest
+              .
+          - echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
+          - docker push git.cloudinit.dev/coreci/orca-traefik:${VERSION}
+          - docker push git.cloudinit.dev/coreci/orca-traefik:latest
+          - docker logout git.cloudinit.dev

Dockerfile.traefik

@@ -0,0 +1,33 @@
+# Dockerfile.traefik — custom orca-traefik image (R-024)
+#
+# Extends the official traefik:v3.3.0 image with a baked default static
+# config. The host-side /etc/traefik/traefik.yml (rendered by
+# emitter.RenderTraefikStaticConfig) is mounted :ro at runtime to
+# override this default — preserving the traefik-on-public-ip opt-out
+# (REQ-100) and any site-local customisation.
+#
+# Dynamic config (routers, services, certs) is mounted from
+# /etc/traefik/dynamic on the host — orca writes to it atomically via
+# the SSH-push transport (C-10 protocol).
+#
+# Build:
+#   docker build -f Dockerfile.traefik -t git.cloudinit.dev/coreci/orca-traefik:v0.13.1 .
+#
+# Run (hybrid R-017 mode — nft DNATs :443/:80 to loopback):
+#   podman run -d --name orca-traefik --restart=unless-stopped \
+#     --network host \
+#     -v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
+#     -v /etc/traefik/dynamic:/etc/traefik/dynamic:ro \
+#     -v /etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro \
+#     git.cloudinit.dev/coreci/orca-traefik:v0.13.1
+
+FROM traefik:v3.3.0
+
+LABEL org.opencontainers.image.title="orca-traefik"
+LABEL org.opencontainers.image.description="Custom Traefik image for Orca ingress (R-024)"
+LABEL org.opencontainers.image.source="https://git.cloudinit.dev/coreci/orca"
+
+COPY docker/orca-traefik/traefik.yml /etc/traefik/traefik.yml
+COPY docker/orca-traefik/step-ca-root.crt /etc/orca/step-ca-root.crt
+
+CMD ["--configFile=/etc/traefik/traefik.yml"]

docker/orca-traefik/traefik.yml

@@ -0,0 +1,19 @@
+entryPoints:
+  websecure:
+    address: "127.0.0.1:8443"
+  web:
+    address: "127.0.0.1:8080"
+  traefik:
+    address: "127.0.0.1:8081"
+
+providers:
+  file:
+    directory: "/etc/traefik/dynamic"
+    watch: true
+
+log:
+  level: INFO
+  format: json
+
+accessLog:
+  format: json

scripts/release.sh

@@ -211,3 +211,36 @@ else
     info "✓ container image ${IMAGE}:${VERSION} published"
   fi
 fi
+
+# --- publish orca-traefik container image (REQ-171, R-024) ----------------
+# Custom traefik image with baked default static config. The host-side
+# traefik.yml is mounted :ro at runtime to override the baked default.
+# Skipped gracefully if docker is not on PATH (CI handles it via
+# .coreci.yml container-publish-traefik step).
+
+TRAEFIK_IMAGE="${CONTAINER_REGISTRY}/${CONTAINER_OWNER}/orca-traefik"
+
+if ! command -v docker >/dev/null 2>&1; then
+  info "docker not found on PATH — skipping orca-traefik image publish (CI handles it)."
+else
+  info "building orca-traefik image ${TRAEFIK_IMAGE}:${VERSION}..."
+  docker build \
+    -f Dockerfile.traefik \
+    -t "${TRAEFIK_IMAGE}:${VERSION}" \
+    -t "${TRAEFIK_IMAGE}:latest" \
+    "$REPO_ROOT"
+
+  if [ -z "${GITEA_TOKEN:-}" ]; then
+    info "GITEA_TOKEN not set — skipping orca-traefik push (image built locally only)."
+  else
+    if ! docker login "$CONTAINER_REGISTRY" -u cloudinit-bot --password-stdin <<<"$GITEA_TOKEN" 2>/dev/null; then
+      echo "$GITEA_TOKEN" | docker login "$CONTAINER_REGISTRY" -u cloudinit-bot --password-stdin
+    fi
+    info "pushing ${TRAEFIK_IMAGE}:${VERSION}..."
+    docker push "${TRAEFIK_IMAGE}:${VERSION}"
+    info "pushing ${TRAEFIK_IMAGE}:latest..."
+    docker push "${TRAEFIK_IMAGE}:latest"
+    docker logout "$CONTAINER_REGISTRY"
+    info "✓ orca-traefik image ${TRAEFIK_IMAGE}:${VERSION} published"
+  fi
+fi