Wire Firefly III and importer into Traefik

Add traefik_proxy network and labels for firefly.jbnel.dev and
import.jbnel.dev with Let's Encrypt TLS. Fix cron to use alpine
with proper crond loop instead of one-shot. Add STATIC_CRON_TOKEN.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -46,3 +46,7 @@ MAIL_FROM=firefly@jbnel.dev
 FIREFLY_III_URL=http://app:8080
 VANITY_URL=https://import.jbnel.dev
 FIREFLY_III_ACCESS_TOKEN=REPLACE_AFTER_FIRST_RUN
+
+# --- Cron ---
+# Generate with: python3 -c "import secrets; print(secrets.token_hex(16))"
+STATIC_CRON_TOKEN=REPLACE_WITH_RANDOM_HEX

docker-compose.yml

@@ -8,6 +8,7 @@ services:
       - firefly_upload:/var/www/html/storage/upload
     networks:
       - firefly
+      - traefik_proxy
     depends_on:
       db:
         condition: service_healthy
@@ -19,17 +20,27 @@ services:
       timeout: 10s
       retries: 3
       start_period: 60s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.firefly.rule=Host(`firefly.jbnel.dev`)"
+      - "traefik.http.routers.firefly.entrypoints=websecure"
+      - "traefik.http.routers.firefly.tls.certresolver=letsencrypt"
+      - "traefik.http.services.firefly.loadbalancer.server.port=8080"
+      - "traefik.docker.network=traefik_proxy"
 
   cron:
-    image: fireflyiii/core:latest
+    image: alpine:latest
     restart: unless-stopped
+    # Calls the Firefly III cron endpoint nightly at 03:00
+    command: >
+      sh -c "echo '0 3 * * * wget -qO- http://app:8080/api/v1/cron/$${STATIC_CRON_TOKEN}'
+      | crontab - && crond -f -l 8"
     env_file: .env
-    command: sh -c "sleep 60 && php /var/www/html/artisan firefly-iii:cron"
-    entrypoint: /bin/sh
     networks:
       - firefly
     depends_on:
-      - app
+      app:
+        condition: service_healthy
 
   importer:
     image: fireflyiii/data-importer:latest
@@ -37,6 +48,7 @@ services:
     env_file: .env
     networks:
       - firefly
+      - traefik_proxy
     depends_on:
       app:
         condition: service_healthy
@@ -46,6 +58,13 @@ services:
       timeout: 10s
       retries: 3
       start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.firefly-importer.rule=Host(`import.jbnel.dev`)"
+      - "traefik.http.routers.firefly-importer.entrypoints=websecure"
+      - "traefik.http.routers.firefly-importer.tls.certresolver=letsencrypt"
+      - "traefik.http.services.firefly-importer.loadbalancer.server.port=8080"
+      - "traefik.docker.network=traefik_proxy"
 
   db:
     image: postgres:16-alpine
@@ -83,3 +102,5 @@ volumes:
 networks:
   firefly:
     driver: bridge
+  traefik_proxy:
+    external: true