fix: Gitea Traefik routing and connection pool optimization

- Remove middleware reference from Gitea Traefik labels (caused routing issues)
- Optimize Gitea connection pool settings (MAX_IDLE_CONNS=30, authentication_timeout=180s)
- Add explicit service reference in Traefik labels
- Fix intermittent 504 timeouts by improving PostgreSQL connection handling

Fixes Gitea unreachability via git.michaelschiemer.de

deployment/ansible/roles/traefik/tasks/restart.yml

@@ -0,0 +1,113 @@
+---
+# Restart and Recreate Traefik Container Tasks
+# Supports both restart (force-recreate) and full recreate (down + up)
+
+- name: Check if Traefik stack directory exists
+  ansible.builtin.stat:
+    path: "{{ traefik_stack_path }}"
+  register: traefik_stack_exists
+
+- name: Fail if Traefik stack directory does not exist
+  ansible.builtin.fail:
+    msg: "Traefik stack directory not found at {{ traefik_stack_path }}"
+  when: not traefik_stack_exists.stat.exists
+
+- name: Check Traefik container status before restart
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose ps {{ traefik_container_name }} --format json
+  register: traefik_status_before
+  changed_when: false
+  failed_when: false
+
+- name: Display Traefik status before restart
+  ansible.builtin.debug:
+    msg: |
+      ================================================================================
+      Traefik Container Status (Before Restart):
+      {{ traefik_status_before.stdout | default('Container not found or Docker not running') }}
+      ================================================================================
+  when: traefik_show_status | default(true) | bool
+
+- name: Recreate Traefik container to apply new configuration
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose up -d --force-recreate {{ traefik_container_name }}
+  register: traefik_restart
+  changed_when: traefik_restart.rc == 0
+  when: traefik_restart_action | default('restart') == 'restart'
+  notify: wait for traefik
+
+- name: Stop and remove Traefik container (full recreate)
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose down {{ traefik_container_name }}
+  register: traefik_down
+  changed_when: traefik_down.rc == 0
+  when: traefik_restart_action | default('restart') == 'recreate'
+
+- name: Create new Traefik container with updated configuration (full recreate)
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose up -d {{ traefik_container_name }}
+  register: traefik_up
+  changed_when: traefik_up.rc == 0
+  when: traefik_restart_action | default('restart') == 'recreate'
+  notify: wait for traefik
+
+- name: Wait for Traefik to be ready
+  ansible.builtin.wait_for:
+    timeout: "{{ traefik_restart_wait_timeout | default(30) }}"
+  changed_when: false
+
+- name: Check Traefik container status after restart
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose ps {{ traefik_container_name }} --format json
+  register: traefik_status_after
+  changed_when: false
+  failed_when: false
+
+- name: Check Traefik health endpoint
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose exec -T {{ traefik_container_name }} traefik healthcheck --ping 2>&1 || echo "HEALTH_CHECK_FAILED"
+  register: traefik_health
+  ignore_errors: yes
+  changed_when: false
+  when: traefik_check_health | default(true) | bool
+
+- name: Check if ACME challenge router is in labels (for recreate action)
+  ansible.builtin.shell: |
+    cd {{ traefik_stack_path }}
+    docker compose ps {{ traefik_container_name }} --format json | jq -r '.[0].Labels' | grep -i 'acme-challenge' || echo "NO_ACME_ROUTER"
+  register: acme_router_check
+  changed_when: false
+  failed_when: false
+  when: traefik_restart_action | default('restart') == 'recreate'
+
+- name: Display final status
+  ansible.builtin.debug:
+    msg: |
+      ========================================
+      Traefik Restart Summary
+      ========================================
+      Action: {{ traefik_restart_action | default('restart') | upper }}
+      Container Status: {% if 'State":"running' in (traefik_status_after.stdout | default('')) %}✅ RUNNING{% else %}❌ NOT RUNNING{% endif %}
+      {% if traefik_check_health | default(true) | bool %}
+      Health Check: {% if 'HEALTH_CHECK_FAILED' not in (traefik_health.stdout | default('')) %}✅ HEALTHY{% else %}❌ UNHEALTHY or TIMEOUT{% endif %}
+      {% endif %}
+      {% if traefik_restart_action | default('restart') == 'recreate' %}
+      ACME Challenge Router: {% if 'NO_ACME_ROUTER' in acme_router_check.stdout %}✅ REMOVED (correct!){% else %}⚠️  Still present in labels{% endif %}
+      {% endif %}
+      Restart Action: {% if (traefik_restart.changed | default(false)) or (traefik_up.changed | default(false)) %}🔄 Container restarted{% else %}ℹ️ No restart needed{% endif %}
+      ========================================
+      {% if 'State":"running' in (traefik_status_after.stdout | default('')) %}
+      ✅ Traefik is running!
+      {% else %}
+      ❌ Traefik is not running. Check logs for details:
+      docker logs {{ traefik_container_name }}
+      {% endif %}
+      ========================================
+  when: traefik_show_status | default(true) | bool
+