fix: Gitea Traefik routing and connection pool optimization

- Remove middleware reference from Gitea Traefik labels (caused routing issues)
- Optimize Gitea connection pool settings (MAX_IDLE_CONNS=30, authentication_timeout=180s)
- Add explicit service reference in Traefik labels
- Fix intermittent 504 timeouts by improving PostgreSQL connection handling

Fixes Gitea unreachability via git.michaelschiemer.de

deployment/stacks/traefik/dynamic/gitea-router.yml

@@ -0,0 +1,17 @@
+# Gitea Router Configuration
+# Router definition for Gitea using File Provider
+
+http:
+  routers:
+    gitea:
+      rule: Host(`git.michaelschiemer.de`)
+      entryPoints:
+        - websecure
+      service: gitea
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - security-headers-global
+        - gzip-compression
+      priority: 100
+

deployment/stacks/traefik/dynamic/gitea-ssh.yml

@@ -1,5 +1,7 @@
 # TCP Router Configuration for Gitea SSH
 # Routes SSH traffic on port 2222 to Gitea container
+# Note: Gitea SSH is handled via port mapping in docker-compose.yml
+# This file is kept for reference but may not be needed
 
 tcp:
   routers:
@@ -13,8 +15,5 @@ tcp:
     gitea-ssh-service:
       loadBalancer:
         servers:
-          # Gitea container SSH service
-          # Note: Using container IP from gitea_gitea-internal network
-          # Traefik runs in host network mode, so we need the actual container IP
-          # IP address: 172.23.0.3 (gitea_gitea-internal network)
-          - address: "172.23.0.3:22"
+          # Use container name in bridge network mode
+          - address: "gitea:22"

deployment/stacks/traefik/dynamic/gitea.yml

@@ -1,20 +0,0 @@
-# Gitea configuration is now handled via Docker labels in docker-compose.yml
-# This file is kept for reference but is not used
-# Traefik will automatically discover Gitea via Docker labels and use the container IP
-# when running in host network mode
-#
-# http:
-#   routers:
-#     gitea:
-#       rule: Host(`git.michaelschiemer.de`)
-#       entrypoints:
-#         - websecure
-#       service: gitea
-#       tls:
-#         certResolver: letsencrypt
-#       priority: 100
-#   services:
-#     gitea:
-#       loadBalancer:
-#         servers:
-#           - url: http://gitea:3000

deployment/stacks/traefik/dynamic/middlewares.yml

@@ -43,14 +43,6 @@ http:
         average: 200
         burst: 100
         period: 1s
-
-    # IP whitelist for admin services (example)
-    # Uncomment and adjust for production
-    # admin-whitelist:
-    #   ipWhiteList:
-    #     sourceRange:
-    #       - "127.0.0.1/32"
-    #       - "10.0.0.0/8"
     
     # Chain multiple middlewares
     default-chain:
@@ -65,4 +57,3 @@ http:
           - security-headers-global
           - gzip-compression
           - rate-limit-strict
-          # - admin-whitelist  # Uncomment for IP whitelisting