The external network on the target server is named "proxy", not traefik-network as originally assumed - deploy was failing with "network traefik-network not found". Updated the compose file and both the infra README and vault deployment doc to match.