feat: migrate all stacks to Coolify (proxy network, clean labels, pull_policy)

- Remove traefik.enable, traefik.docker.network, traefik.http.routers.* from all services
- Keep traefik.http.services.<name>.loadbalancer.server.port labels
- Keep all middleware definitions (forwardauth, headers, redirects)
- Add pull_policy: always to main/frontend services
- Add proxy network + label to gitea and karakeep (previously missing)
- Add COOLIFY-TEMPLATE.md reference guide

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nextcloud/docker-compose.yml

@@ -34,6 +34,7 @@ services:
   nextcloud:
     image: nextcloud:33-apache
     container_name: nextcloud
+    pull_policy: always
     restart: unless-stopped
     depends_on:
       - nextcloud-db
@@ -79,15 +80,6 @@ services:
       - proxy
       - mail_internal
     labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-
-      - traefik.http.routers.nextcloud.rule=Host(`${NC_DOMAIN}`)
-      - traefik.http.routers.nextcloud.entrypoints=websecure
-      - traefik.http.routers.nextcloud.tls=true
-      - traefik.http.routers.nextcloud.tls.certresolver=${TRAEFIK_CERTRESOLVER}
-      - traefik.http.routers.nextcloud.middlewares=nc-dav,nc-secure-headers
-
       - traefik.http.middlewares.nc-dav.redirectregex.permanent=true
       - traefik.http.middlewares.nc-dav.redirectregex.regex=https://(.*)/.well-known/(?:card|cal)dav
       - traefik.http.middlewares.nc-dav.redirectregex.replacement=https://$${1}/remote.php/dav
@@ -156,15 +148,6 @@ services:
       - nextcloud_internal
       - proxy
     labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-
-      - traefik.http.routers.onlyoffice.rule=Host(`${OO_DOMAIN}`)
-      - traefik.http.routers.onlyoffice.entrypoints=websecure
-      - traefik.http.routers.onlyoffice.tls=true
-      - traefik.http.routers.onlyoffice.tls.certresolver=${TRAEFIK_CERTRESOLVER}
-      - traefik.http.routers.onlyoffice.middlewares=oo-secure-headers,oo-forwarded
-
       - traefik.http.middlewares.oo-secure-headers.headers.stsSeconds=31536000
       - traefik.http.middlewares.oo-secure-headers.headers.stsIncludeSubdomains=true
       - traefik.http.middlewares.oo-secure-headers.headers.stsPreload=true