asset-engine: drop traefik wiring, LAN-direct only

Internal tooling — accessed at http://10.250.50.70:8200, not through
Traefik. Removes the unused traefik labels (router rule, TLS, crowdsec
middleware, loadbalancer port) and the traefik-net network membership;
homepage.href now points at host:port for direct discovery, matching
task-board's pattern. Playbook verify drops the traefik-net membership
check.

playbooks/deploy-asset-engine.yaml

@@ -13,7 +13,6 @@
 #
 # Prereqs on the target host:
 #   - Docker + docker compose plugin
-#   - `traefik-net` docker network (external)
 #   - Target user (lkraven) has git SSH access to gitea.phasefinal.com
 #     — either SSH key authorized in gitea, or the repo is HTTPS-reachable
 #     if you swap `repo_url` below.
@@ -128,9 +127,3 @@ verify:
   - name: /health body reports status=ok
     shell: curl -sf http://localhost:{{ host_port }}/health | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"'
     changed_when: "false"
-
-  - name: Container is in the traefik-net network
-    # `traefik-net` has a dash, so it's not accessible via Go template dot
-    # syntax — JSON-encode the networks map and grep for the key instead.
-    shell: docker inspect asset-engine --format '{{json .NetworkSettings.Networks}}' | grep -q traefik-net
-    changed_when: "false"

stacks/asset-engine/.env.example

@@ -7,13 +7,10 @@
 ASSET_ENGINE_IMAGE=asset-engine:local
 
 # Host port exposing the FastAPI app (container listens on 8000 internally).
-# Internal-only tool — LAN access on this port is the primary entry; the
-# Traefik labels in compose.yaml additionally route the public hostname.
+# Internal tooling, LAN-only — this port is the only entry point. No Traefik.
 ASSET_ENGINE_PORT=8200
 
-# Bind address for the host port. 0.0.0.0 = LAN-reachable (default for an
-# internal-only tool). Flip to 127.0.0.1 only if you want to force all
-# traffic through traefik.
+# Bind address for the host port. 0.0.0.0 = LAN-reachable.
 ASSET_ENGINE_BIND=0.0.0.0
 
 # Host paths for state. Container runs as uid 1000 — paths must be writable

stacks/asset-engine/README.md

@@ -7,8 +7,7 @@ over WG by default), and persists generated assets to a local SQLite
 DB + content-addressed blob store.
 
 **Server:** ana-docker
-**Hostname (TLS):** `asset-engine.phasefinal.com` (TLS via Traefik / `anaprod` cert resolver)
-**LAN port:** `10.250.50.70:8200` (configurable via `.env`)
+**URL:** `http://10.250.50.70:8200` (configurable via `.env`)
 **Upstream repo:** [vh/asset-engine](https://gitea.phasefinal.com/vh/asset-engine)
 **Image:** `asset-engine:local` — built on the host from the git repo by
 the deploy playbook. Not pulled from a registry.
@@ -55,14 +54,11 @@ scripts/elway ana-docker --playbook playbooks/deploy-asset-engine.yaml --var ref
 
 ## Network model
 
-Internal-only tool, two entry points:
-
-- **LAN**, default: `http://10.250.50.70:8200` — container port 8000
-  published on the host, bound to 0.0.0.0 (configurable via
-  `ASSET_ENGINE_BIND` / `ASSET_ENGINE_PORT`).
-- **TLS hostname**: `https://asset-engine.phasefinal.com` — Traefik on
-  ana-docker terminates TLS and forwards to the container over the
-  `traefik-net` docker network on port 8000.
+Internal tooling, LAN-only. Container port 8000 is published on the host
+at `0.0.0.0:8200` (configurable via `ASSET_ENGINE_BIND` /
+`ASSET_ENGINE_PORT`); access is direct via `http://10.250.50.70:8200`.
+No Traefik, no TLS terminator, no public hostname. If we later need
+TLS or external access, that's a separate decision.
 
 `INFERENCE_HOST` defaults to `10.100.79.3` (irv-ml1 over WG). Override
 in `.env` if the fleet's inference topology moves.

stacks/asset-engine/compose.yaml

@@ -13,9 +13,10 @@
 # asset-engine:local .` before installing this compose and bringing
 # it up. No registry.
 #
-# State persists under /opt/docker/conf/asset-engine/{db,outputs} on
-# the host — separate bind-mounts so outputs/ can move to a bigger
-# volume later without touching DB state.
+# Internal tooling — accessed directly on host:port over the LAN, does
+# NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/
+# {db,outputs} on the host — separate bind-mounts so outputs/ can move
+# to a bigger volume later without touching DB state.
 #
 # All tunables live in .env — edit that, not this file.
 
@@ -44,23 +45,9 @@ services:
       timeout: 5s
       retries: 3
       start_period: 30s
-    networks:
-      - tnet
     labels:
-      - traefik.enable=true
-      - traefik.http.routers.asset-engine.rule=Host(`asset-engine.phasefinal.com`)
-      - traefik.http.routers.asset-engine.entrypoints=websecure
-      - traefik.http.routers.asset-engine.tls=true
-      - traefik.http.routers.asset-engine.tls.certresolver=anaprod
-      - traefik.http.routers.asset-engine.middlewares=crowdsec@file
-      - traefik.http.services.asset-engine.loadbalancer.server.port=8000
       - homepage.group=AI Systems
       - homepage.name=Asset Engine
       - homepage.icon=mdi-tools
       - homepage.description=Control plane over the PFI inference fleet
-      - homepage.href=https://asset-engine.phasefinal.com
-
-networks:
-  tnet:
-    name: traefik-net
-    external: true
+      - homepage.href=http://10.250.50.70:${ASSET_ENGINE_PORT}