Switch to Caddy Docker Proxy labels for automatic HTTPS

Co-authored-by: Junie <junie@jetbrains.com>

docker-compose.prod.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   # PostgreSQL — база данных
   postgres:
@@ -44,32 +42,46 @@ services:
       MAILSERVER_RELAY_PORT: 25
       MAILSERVER_DKIM_DOMAIN: jambotron.com
     ports:
-      - "8080:8080"   # REST API (через Caddy)
-      - "3025:3025"   # SMTP входящие
+      - "3025:3025"   # SMTP входящие (не через Caddy)
     volumes:
       - attachments:/app/attachments
       - dkim-keys:/app/dkim-keys
+      - ./frontend/dist/frontend/browser:/usr/share/caddy  # Статический фронтенд
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
       interval: 30s
       timeout: 5s
       retries: 3
+    labels:
+      # Caddy Docker Proxy — автоматический HTTPS + reverse proxy
+      caddy: mail.jambotron.com
+      caddy.route.api.reverse_proxy: "*{{upstreams 8080}}"
+      caddy.route.api.header_up.Host: "{host}"
+      caddy.route.api.header_up.X-Real-IP: "{remote_host}"
+      caddy.route.api.header_up.X-Forwarded-For: "{remote_host}"
+      caddy.route.api.header_up.X-Forwarded-Proto: "{scheme}"
+      # Статический фронтенд (Angular) — file_server для всех остальных путей
+      caddy.route.static.root: "* /usr/share/caddy"
+      caddy.route.static.file_server: "*"
+      caddy.route.static.encode: "gzip"
 
-  # Caddy — reverse proxy с HTTPS
+  # Caddy Docker Proxy — автоматически генерирует Caddyfile из labels
   caddy:
-    image: caddy:2-alpine
+    image: lucaslorentz/caddy-docker-proxy:2.8-alpine
     container_name: mail-caddy
     restart: unless-stopped
-    depends_on:
-      - mail-server
     ports:
       - "80:80"
       - "443:443"
+      - "443:443/udp"  # ACME DNS-01 challenge
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /var/run/docker.sock:/var/run/docker.sock:ro
       - caddy-data:/data
       - caddy-config:/config
-      - ./frontend/dist/frontend/browser:/usr/share/caddy
+    environment:
+      CADDY_DOCKER_CADDYFILE: ""
+      CADDY_DOCKER_AGREE: "true"
+      CADDY_DOCKER_TLS_DEFAULT_ROUTE: "true"
 
 volumes:
   pgdata: