Refactor the site container from a TLS-owning, port-binding proxy into an
internal plaintext static server that sits behind a dedicated edge reverse
proxy, and add an automated build/deploy pipeline.
- Caddyfile: single :80 listener (auto_https off), Host-matcher routing for
apex/blog/art/code with /_astro+/assets re-root and www->apex redirect
- Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy)
- compose.yml: pull registry image, join external 'edge' network, declare
routing via caddy-docker-proxy labels; drop build/ports/cert volumes
- compose.dev.yml: local container preview on :8080
- .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes
to the Forgejo registry, SSH-deploys to the VPS
- docs + .dockerignore updated for the new topology
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
