fix(compose): scope upstream spoof aliases to mirror mode

The spoof aliases (maven.neoforged.net, libraries.minecraft.net, etc.) hijacked
those hostnames for every mcnet container, so the ONLINE NeoForge install during
pre-bake hit the empty mirror (cert path failure). Moved them to the mirror
override; core/static modes resolve the real upstreams.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.mirror.yml

@@ -10,3 +10,16 @@ services:
     volumes:
       - ./caddy/conf.d/20-mirror.caddy:/etc/caddy/conf.d/20-mirror.caddy:ro
       - ./mirror/upstream:/srv/mirror:ro
+    networks:
+      mcnet:
+        # Spoof the real upstream hosts -> Caddy (air-gap runtime only). Includes
+        # the base aliases because compose replaces (not merges) the alias list.
+        aliases:
+          - "auth.${BASE_DOMAIN}"
+          - "packwiz.${BASE_DOMAIN}"
+          - "meta.prismlauncher.org"
+          - "piston-meta.mojang.com"
+          - "piston-data.mojang.com"
+          - "libraries.minecraft.net"
+          - "maven.neoforged.net"
+          - "resources.download.minecraft.net"

docker-compose.yml

@@ -45,18 +45,13 @@ services:
       - ./pack:/srv/pack:ro
     networks:
       mcnet:
-        # All subdomain aliases live here (harmless when a vhost snippet isn't
+        # Only the stack's own subdomains in the base. The upstream spoof-host
-        # mounted; lets internal containers resolve them to Caddy). The spoof
+        # aliases live in docker-compose.mirror.yml — adding them here would
-        # hosts only actually serve content when the mirror snippet is present.
+        # hijack maven.neoforged.net / libraries.minecraft.net for ALL mcnet
+        # containers, breaking the ONLINE NeoForge install during pre-bake.
         aliases:
           - "auth.${BASE_DOMAIN}"
           - "packwiz.${BASE_DOMAIN}"
-          - "meta.prismlauncher.org"
-          - "piston-meta.mojang.com"
-          - "piston-data.mojang.com"
-          - "libraries.minecraft.net"
-          - "maven.neoforged.net"
-          - "resources.download.minecraft.net"
 
   drasl:
     image: unmojang/drasl:latest