ops: add Caddyfile + landing + DB url

deploy/Caddyfile

@@ -0,0 +1,67 @@
+{
+	# HTTP/1.1 + HTTP/2 + HTTP/3 (QUIC). Cloudflare serves h3 to browsers;
+	# origin↔CF is TCP, but enabling h3 here is harmless + future-proof.
+	servers {
+		protocols h1 h2 h3
+	}
+}
+
+# Shared security headers. (No strict CSP yet — the app uses inline
+# scripts; we'll add a nonce-based CSP later.)
+(sechdrs) {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "SAMEORIGIN"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		-Server
+	}
+}
+
+# All sites use the Cloudflare Origin cert (valid to 2041, no ACME/renewal).
+(cfcert) {
+	tls /etc/ssl/cannabuddy/origin.crt /etc/ssl/cannabuddy/origin.key
+}
+
+# --- Marketing landing (apex) ---
+cannabuddy.eu, www.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	root * /var/www/cannabuddy-landing
+	file_server
+}
+
+# --- App (PWA) ---  tenant resolved by login, not subdomain
+app.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	# MQTT-over-WebSocket → Mosquitto ws listener (localhost)
+	@mqtt path /mqtt /mqtt/*
+	reverse_proxy @mqtt 127.0.0.1:8083
+	# everything else → Astro SSR (Node/pm2)
+	reverse_proxy 127.0.0.1:7502
+}
+
+# --- Superadmin console (same app, host-routed; lock behind CF Access) ---
+admin.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	encode zstd gzip
+	reverse_proxy 127.0.0.1:7502
+}
+
+# --- Forgejo ---
+git.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	reverse_proxy 127.0.0.1:3000
+}
+
+# --- Status (Uptime Kuma) ---
+status.cannabuddy.eu {
+	import cfcert
+	import sechdrs
+	reverse_proxy 127.0.0.1:3001
+}