Веб-почта по HTTPS на том же адресе: https://mail.jambocheck.com (порт 443)

HTTPS_PORT — второй Netty-сервер с тем же HttpHandler и тем же сертификатом, что SMTP/IMAP
(Let's Encrypt от acme, перечитывается при продлении). HSTS добавляет Spring Security.
docker-compose.public.yml: 443 → 8443. HTTP 8080 остаётся для прокси внутри сети.
Тесты: HttpsConfigTest, всего 74; живой запуск: /api/config по HTTPS, HSTS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.public.yml

@@ -8,7 +8,8 @@
 #   465  SMTPS: mail programs, implicit TLS
 #   993  IMAPS: mail programs, implicit TLS
 #   80   only for Let's Encrypt (HTTP-01) — service "acme"
-# The web client + API (service "mail", port 8080) goes through Jambotron's Caddy under ANOTHER name
+#   443  web client + API over HTTPS, same Let's Encrypt certificate (acme): https://mail.jambocheck.com
+# The web client + API can also go through Jambotron's Caddy (plain port 8080) under ANOTHER name
 # (webmail.<domain>): the name MAIL_HOSTNAME points at the VM's public address, not at Caddy.
 #
 # DNS before the first start (the certificate is issued over HTTP on MAIL_HOSTNAME):
@@ -121,8 +122,9 @@ services:
       - "587:3025"
       - "465:3465"
       - "993:3993"
+      - "443:8443"   # web client + API over HTTPS: https://mail.jambocheck.com
     expose:
-      - "8080"   # web client + API → webmail.<domain> in Jambotron
+      - "8080"   # plain HTTP, for a reverse proxy inside the network (not needed on the public address)
     environment:
       DB_HOST: db
       MAILSERVER_SECRETS_DIR: /run/mail-secrets
@@ -132,6 +134,7 @@ services:
       MAIL_TLS_KEY: /tls/key.pem
       SMTPS_PORT: "3465"
       IMAPS_PORT: "3993"
+      HTTPS_PORT: "8443"
       DKIM_DOMAIN: ${MAIL_DOMAINS:-jambocheck.com}
       DKIM_SELECTOR: mail
       DKIM_KEYS_DIR: /app/data/dkim-keys