feat: lodge server, client and admin

caddy/.env.example

@@ -0,0 +1,2 @@
+LODGE_DOMAIN=lodge.localhost
+CLOUDFLARE_API_TOKEN=

caddy/.gitignore

@@ -0,0 +1,2 @@
+.env
+Caddyfile

caddy/Caddyfile.example

@@ -0,0 +1,14 @@
+{
+	admin localhost:2019
+
+	log {
+		format console
+	}
+
+	servers {
+		trusted_proxies cloudflare
+		client_ip_headers Cf-Connecting-Ip
+	}
+}
+
+import /etc/caddy/projects.d/*/site.caddy

caddy/README.md

@@ -0,0 +1,22 @@
+# caddy
+
+`site.caddy` routes `{$LODGE_DOMAIN}` to the project's services over the external `caddy` docker network. It works standalone and inside a shared Caddy that fronts several projects.
+
+Standalone:
+
+```sh
+docker network create caddy
+cp Caddyfile.example Caddyfile
+cp .env.example .env
+docker compose up -d
+```
+
+Shared Caddy: mount this directory as `/etc/caddy/projects.d/lodge:ro`, keep `import /etc/caddy/projects.d/*/site.caddy` in its Caddyfile and put `LODGE_DOMAIN` in its environment.
+
+Rules that keep `site.caddy` portable:
+
+- the domain comes only from the environment variable
+- no `tls` block, certificates are configured by the host Caddy (`acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}` in the global block)
+- snippets are prefixed with the project slug because Caddy snippets are global
+- mount the directory, not the file: a single-file bind mount goes stale when git replaces the inode
+- keep `admin localhost:2019`, `admin off` makes `caddy reload` impossible

caddy/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  caddy:
+    image: ghcr.io/caddybuilds/caddy-cloudflare:latest
+    restart: unless-stopped
+    ports:
+      - "0.0.0.0:80:80"
+      - "0.0.0.0:443:443"
+      - "0.0.0.0:443:443/udp"
+    networks:
+      - caddy
+    env_file:
+      - .env
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - .:/etc/caddy/projects.d/lodge:ro
+      - caddy_data:/data
+
+networks:
+  caddy:
+    external: true
+
+volumes:
+  caddy_data:

caddy/site.caddy

@@ -0,0 +1,5 @@
+{$LODGE_DOMAIN} {
+	encode zstd gzip
+
+	reverse_proxy lodge-api:8080
+}