refactor(ingress): extract caddy to its own compose file; add nginx path

Caddy is no longer in the base stack. Two ingress paths now:
- docker-compose.caddy.yml — LAN/air-gap; build-stack.sh adds it for all
  up modes + the prep pre-bake. Holds the mcnet auth./pack. aliases.
- docker-compose.nginx.yml — production behind the host's nginx: publishes
  drasl on 127.0.0.1:25585, points minecraft at the host (extra_hosts) over
  HTTPS for pack + authlib.

Base loses the caddy service and minecraft's caddy depends_on (re-added by
caddy.yml). Blessing Skin override now requires caddy.yml (it only swaps
caddy's core conf).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -5,45 +5,21 @@
 # DNS is provided by YOUR party DNS server — see tooling/dns-records.sh for the
 # records to add (online vs airgap). A turnkey dnsmasq is available as an
 # optional layer: docker-compose.dnsmasq.yml.
-#   - caddy is the only HTTP ingress; holds mcnet aliases so the stack
-#     resolves auth.${BASE_DOMAIN} / packwiz.${BASE_DOMAIN} internally too
+#   - ingress is layered on, NOT in this base file: caddy (docker-compose.caddy.yml,
+#     LAN/air-gap, holds mcnet aliases) OR the host's nginx (docker-compose.nginx.yml
+#     + Let's Encrypt, production)
 #   - drasl handles auth (password login; NO Keycloak/OIDC in this stack)
-#   - packwiz pack is served by caddy at packwiz.${BASE_DOMAIN}
+#   - packwiz pack is served by the ingress at pack.${BASE_DOMAIN}
 #   - minecraft installs mods via PACKWIZ_URL, authlib-injector -> auth.
 # ──────────────────────────────────────────────────────────────────
 
 services:
-  # Core ingress. Static site + air-gap mirror are layered in via override
-  # files (docker-compose.static.yml / .mirror.yml) — see build-stack.sh --up.
-  caddy:
-    image: caddy:alpine
-    container_name: caddy
-    restart: unless-stopped
-    ports:
-      - "80:80"
-    environment:
-      BASE_DOMAIN: ${BASE_DOMAIN}
-    volumes:
-      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ./caddy/conf.d/00-core.caddy:/etc/caddy/conf.d/00-core.caddy:ro
-      - ./caddy/conf.d/10-static.caddy:/etc/caddy/conf.d/10-static.caddy:ro
-      - ./www:/srv/www:ro
-      - ./mirror/launcher:/srv/launcher:ro
-      - ./caddy/caddy-root-ca.crt:/srv/ca-pub/ca.crt:ro
-      - ./pack:/srv/pack:ro
-      # Custom (locally-hosted) mod jars live OUTSIDE ./pack so packwiz refresh
-      # doesn't index them as direct files — they're external download targets
-      # referenced by pack/mods/*.pw.toml. Served at pack.${BASE_DOMAIN}/custom/.
-      - ./custom:/srv/pack/custom:ro
-    networks:
-      mcnet:
-        # Only the stack's own subdomains in the base. The upstream spoof-host
-        # aliases live in docker-compose.mirror.yml — adding them here would
-        # hijack maven.neoforged.net / libraries.minecraft.net for ALL mcnet
-        # containers, breaking the ONLINE NeoForge install during pre-bake.
-        aliases:
-          - "auth.${BASE_DOMAIN}"
-          - "pack.${BASE_DOMAIN}"
+  # NOTE: the HTTP(S) ingress is NOT in this base file.
+  #   - LAN / air-gap: caddy (docker-compose.caddy.yml) — added by build-stack.sh
+  #   - production:    the HOST's nginx + Let's Encrypt (docker-compose.nginx.yml
+  #                    publishes drasl to localhost; nginx/ulicraft.conf.tmpl)
+  # Base alone (drasl + minecraft + mc-backup) is not a complete deployment —
+  # always layer one ingress file on top.
   drasl:
     image: unmojang/drasl:latest
     container_name: drasl
@@ -95,7 +71,9 @@ services:
       ENFORCE_SECURE_PROFILE: "FALSE"  # required for authlib-injector on 1.21+
       ALLOW_FLIGHT: "TRUE"             # many tech mods need this
 
-      # ── Mod source: packwiz pack served by caddy ────────────────
+      # ── Mod source: packwiz pack served by the ingress ──────────
+      # http + caddy alias by default; the nginx override switches this to
+      # https + host-gateway (extra_hosts) for the production path.
       PACKWIZ_URL: "http://pack.${BASE_DOMAIN}/pack.toml"
 
       # ── RCON for remote admin ───────────────────────────────────
@@ -108,8 +86,7 @@ services:
       - mc_data:/data
       - ./runtime:/extras:ro       # authlib-injector.jar lives here
     depends_on:
-      - drasl
-      - caddy                      # packwiz pack is served by caddy
+      - drasl                      # ingress (caddy/nginx) is layered separately
     networks:
       - mcnet