Initial commit: Matrix stack (Synapse + Synapse-Admin + Element Web) behind Traefik

Fully dockerized deployment with automatic Let's Encrypt certificates via
Traefik's static file provider (no docker.sock needed), bind-mounted data
folders instead of named volumes, and domain/secrets kept out of git via
.env + rendered templates.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

traefik/dynamic/middlewares.yml

@@ -0,0 +1,17 @@
+http:
+  middlewares:
+    secure-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        forceSTSHeader: true
+        contentTypeNosniff: true
+        browserXssFilter: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+
+    dashboard-auth:
+      basicAuth:
+        users:
+          - '{{ env "TRAEFIK_DASHBOARD_AUTH" }}'

traefik/dynamic/routes.yml.template

@@ -0,0 +1,73 @@
+http:
+  routers:
+    synapse:
+      rule: "Host(`${MATRIX_SUBDOMAIN}.${DOMAIN}`)"
+      entrypoints:
+        - websecure
+      service: synapse
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - secure-headers
+
+    element:
+      rule: "Host(`${ELEMENT_SUBDOMAIN}.${DOMAIN}`)"
+      entrypoints:
+        - websecure
+      service: element
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - secure-headers
+
+    synapse-admin:
+      rule: "Host(`${ADMIN_SUBDOMAIN}.${DOMAIN}`)"
+      entrypoints:
+        - websecure
+      service: synapse-admin
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - secure-headers
+
+    wellknown:
+      rule: "Host(`${DOMAIN}`)"
+      entrypoints:
+        - websecure
+      service: wellknown
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - secure-headers
+
+    dashboard:
+      rule: "Host(`${TRAEFIK_SUBDOMAIN}.${DOMAIN}`)"
+      entrypoints:
+        - websecure
+      service: api@internal
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - dashboard-auth
+        - secure-headers
+
+  services:
+    synapse:
+      loadBalancer:
+        servers:
+          - url: "http://matrix-synapse:8008"
+
+    element:
+      loadBalancer:
+        servers:
+          - url: "http://matrix-element:80"
+
+    synapse-admin:
+      loadBalancer:
+        servers:
+          - url: "http://matrix-synapse-admin:80"
+
+    wellknown:
+      loadBalancer:
+        servers:
+          - url: "http://matrix-wellknown:80"