Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/traefik/templates/docker-compose.yml.j2

@@ -6,13 +6,14 @@ services:
     security_opt:
       - no-new-privileges:true
     ports:
-      - "80:80"
       - "443:443"
+      - "8081:8080"
     environment:
       CF_DNS_API_TOKEN: {{ cloudflare_api_token }}
+      CLOUDFLARE_EMAIL: {{ traefik_acme_email }}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - {{ traefik_data_dir }}/acme/acme.json:/acme.json
+      - {{ traefik_data_dir }}/letsencrypt:/letsencrypt
       - {{ traefik_data_dir }}/dynamic:/dynamic
     command:
       - --api.dashboard={{ traefik_dashboard_enabled | lower }}
@@ -22,19 +23,20 @@ services:
       - --providers.docker.network={{ docker_network_name }}
       - --providers.file.directory=/dynamic
       - --providers.file.watch=true
-      - --entrypoints.web.address=:80
-      - --entrypoints.web.http.redirections.entrypoint.to=websecure
       - --entrypoints.websecure.address=:443
-      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
-      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
-      - --certificatesresolvers.cloudflare.acme.email={{ traefik_acme_email }}
-      - --certificatesresolvers.cloudflare.acme.storage=/acme.json
-      - --certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
+      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
+      - --entrypoints.websecure.http.tls.domains[0].main=hobbs.farm
+      - --entrypoints.websecure.http.tls.domains[0].sans=*.hobbs.farm
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
+      - --certificatesresolvers.letsencrypt.acme.email={{ traefik_acme_email }}
+      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/hf.json
+      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
     labels:
       traefik.enable: "true"
       traefik.http.routers.traefik.rule: "Host(`{{ traefik_dashboard_host }}`)"
       traefik.http.routers.traefik.entrypoints: websecure
-      traefik.http.routers.traefik.tls.certresolver: cloudflare
+      traefik.http.routers.traefik.tls.certresolver: letsencrypt
       traefik.http.routers.traefik.tls.domains[0].main: "{{ domain }}"
       traefik.http.routers.traefik.tls.domains[0].sans: "*.{{ domain }}"
       traefik.http.routers.traefik.service: api@internal