worktree-devproxy

One shared Traefik + one compose stack per git worktree. Each instance is reachable at http://<worktree>.<repo>.localhost:8000; a laptop reaches it through a single SSH tunnel. Nothing else touches the host network.

laptop browser → SSH tunnel (:8000) → Traefik (127.0.0.1 only)
              → Host-header match → per-worktree compose stack (devproxy network)

Invariants (don't trade these away when adapting):

1. No host ports except Traefik's own 127.0.0.1:8000 (web) and 127.0.0.1:8080 (dashboard/API). Everything else flows over the shared external docker network devproxy.
2. Routing is Host-header only — *.localhost resolves to loopback by OS convention, so there is no DNS, no TLS, and no port allocation table.
3. Worktree isolation is COMPOSE_PROJECT_NAME (set by .envrc via direnv): independent networks, volumes, and container names per worktree.

One-time machine setup

Prerequisites: docker (with compose plugin), git, direnv (hook it into the shell rc).