ops: add Caddyfile + landing + DB url

deploy/Caddyfile

@@ -0,0 +1,67 @@
+{
+	# HTTP/1.1 + HTTP/2 + HTTP/3 (QUIC). Cloudflare serves h3 to browsers;
+	# origin↔CF is TCP, but enabling h3 here is harmless + future-proof.
+	servers {
+		protocols h1 h2 h3
+	}
+}
+
+# Shared security headers. (No strict CSP yet — the app uses inline
+# scripts; we'll add a nonce-based CSP later.)
+(sechdrs) {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "SAMEORIGIN"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		-Server
+	}
+}
+
+# All sites use the Cloudflare Origin cert (valid to 2041, no ACME/renewal).
+(cfcert) {
+	tls /etc/ssl/cannabuddy/origin.crt /etc/ssl/cannabuddy/origin.key
+}
+
+# --- Marketing landing (apex) ---
+cannabuddy.eu, www.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	root * /var/www/cannabuddy-landing
+	file_server
+}
+
+# --- App (PWA) ---  tenant resolved by login, not subdomain
+app.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	# MQTT-over-WebSocket → Mosquitto ws listener (localhost)
+	@mqtt path /mqtt /mqtt/*
+	reverse_proxy @mqtt 127.0.0.1:8083
+	# everything else → Astro SSR (Node/pm2)
+	reverse_proxy 127.0.0.1:7502
+}
+
+# --- Superadmin console (same app, host-routed; lock behind CF Access) ---
+admin.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	reverse_proxy 127.0.0.1:7502
+}
+
+# --- Forgejo ---
+git.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	reverse_proxy 127.0.0.1:3000
+}
+
+# --- Status (Uptime Kuma) ---
+status.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	reverse_proxy 127.0.0.1:3001
+}

deploy/landing/index.html

@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="de">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="dark">
+  <meta name="theme-color" content="#0f1419">
+  <title>CannaBuddy</title>
+  <style>
+    :root{ --bg:#131820; --surface:#1a2027; --text:#e2e5e9; --muted:#8b9199; --green:#46b46e }
+    *{box-sizing:border-box}
+    body{margin:0;min-height:100vh;background:var(--bg);color:var(--text);
+      font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+      display:flex;align-items:center;justify-content:center;text-align:center;padding:24px;-webkit-font-smoothing:antialiased}
+    .card{max-width:440px}
+    .dot{display:inline-block;width:10px;height:10px;border-radius:50%;background:var(--green);
+      box-shadow:0 0 0 0 rgba(70,180,110,.6);animation:p 2s infinite}
+    @keyframes p{0%{box-shadow:0 0 0 0 rgba(70,180,110,.5)}70%{box-shadow:0 0 0 14px rgba(70,180,110,0)}100%{box-shadow:0 0 0 0 rgba(70,180,110,0)}}
+    h1{font-size:2rem;margin:.4em 0 .2em;letter-spacing:-.01em}
+    .g{color:var(--green)}
+    p{color:var(--muted);line-height:1.5}
+    a{color:var(--green);text-decoration:none}
+  </style>
+</head>
+<body>
+  <div class="card">
+    <span class="dot"></span>
+    <h1>Canna<span class="g">Buddy</span></h1>
+    <p>Hydroponik-Monitoring für Cannabis Social Clubs.<br>Die Plattform wird gerade aufgebaut.</p>
+    <p><a href="https://app.cannabuddy.eu">→ Zur App</a></p>
+  </div>
+</body>
+</html>