refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -1,31 +1,31 @@
 # ──────────────────────────────────────────────────────────────────
 # Ulicraft LAN-party stack — Minecraft 1.21.1 NeoForge + Drasl auth
 # ──────────────────────────────────────────────────────────────────
-# Single source of config: BASE_DOMAIN + HOST_LAN_IP in .env.
-# DNS is provided by YOUR party DNS server — see tooling/dns-records.sh for the
-# records to add (online vs airgap). A turnkey dnsmasq is available as an
-# optional layer: docker-compose.dnsmasq.yml.
-#   - ingress is layered on, NOT in this base file: caddy (docker-compose.caddy.yml,
-#     LAN/air-gap, holds mcnet aliases) OR the host's nginx (docker-compose.nginx.yml
-#     + Let's Encrypt, production)
-#   - drasl handles auth (password login; NO Keycloak/OIDC in this stack)
-#   - packwiz pack is served by the ingress at pack.${BASE_DOMAIN}
-#   - minecraft installs mods via PACKWIZ_URL, authlib-injector -> auth.
+# Single, unified compose. One file holds the whole stack:
+#   drasl        auth + skins (Yggdrasil), internal only
+#   minecraft    the server (itzg/NEOFORGE), installs mods via packwiz
+#   mc-backup    world backups every 6h via RCON
+#   caddy        internal ingress — routes auth./pack./apex/launcher/avatar.
+#                /distribution. by Host header (conf.d/*.caddy)
+#   nmsr         skin/avatar renderer at avatar.${BASE_DOMAIN}
+#   uptime-kuma  status monitoring at status.${BASE_DOMAIN}
+#
+# Bring up:  docker compose up -d   (render configs first: tooling/render-config.sh)
+#
+# DNS is handled OUTSIDE this repo — point every service name at the host.
+# Production TLS terminates at the HOST's nginx in front of caddy
+# (nginx/ulicraft-caddy.conf.tmpl + Let's Encrypt); caddy is published on a
+# localhost-only port (CADDY_HTTP_BIND/CADDY_HTTP_PORT in .env). Containers reach
+# the stack's own names internally via caddy's mcnet aliases (auth./pack.).
 # ──────────────────────────────────────────────────────────────────
 
 services:
-  # NOTE: the HTTP(S) ingress is NOT in this base file.
-  #   - LAN / air-gap: caddy (docker-compose.caddy.yml) — added by build-stack.sh
-  #   - production:    the HOST's nginx + Let's Encrypt (docker-compose.nginx.yml
-  #                    publishes drasl to localhost; nginx/ulicraft.conf.tmpl)
-  # Base alone (drasl + minecraft + mc-backup) is not a complete deployment —
-  # always layer one ingress file on top.
   drasl:
     image: unmojang/drasl:latest
     container_name: drasl
     restart: unless-stopped
-    # Internal-only: no published host port. Reached via Caddy at
-    # auth.${BASE_DOMAIN} (Caddy holds the network alias on mcnet).
+    # Internal-only: no published host port. Reached via caddy at
+    # auth.${BASE_DOMAIN} (caddy holds the network alias on mcnet).
     volumes:
       - ./drasl/config:/etc/drasl:ro
       - drasl_state:/var/lib/drasl
@@ -58,7 +58,7 @@ services:
 
       # ── Auth: offline mode + authlib-injector pointing at Drasl ─
       ONLINE_MODE: "FALSE"
-      # mount authlib-injector.jar at /extras/authlib-injector.jar
+      # Resolves over mcnet to caddy (alias auth.${BASE_DOMAIN}) -> drasl.
       JVM_OPTS: "-javaagent:/extras/authlib-injector.jar=http://auth.${BASE_DOMAIN}/authlib-injector"
 
       # ── Server config ───────────────────────────────────────────
@@ -71,9 +71,7 @@ services:
       ENFORCE_SECURE_PROFILE: "FALSE"  # required for authlib-injector on 1.21+
       ALLOW_FLIGHT: "TRUE"             # many tech mods need this
 
-      # ── Mod source: packwiz pack served by the ingress ──────────
-      # http + caddy alias by default; the nginx override switches this to
-      # https + host-gateway (extra_hosts) for the production path.
+      # ── Mod source: packwiz pack served by caddy (alias pack.) ──
       PACKWIZ_URL: "http://pack.${BASE_DOMAIN}/pack.toml"
 
       # ── RCON for remote admin ───────────────────────────────────
@@ -86,11 +84,11 @@ services:
       - mc_data:/data
       - ./runtime:/extras:ro       # authlib-injector.jar lives here
     depends_on:
-      - drasl                      # ingress (caddy/nginx) is layered separately
+      - drasl
+      - caddy                      # pack./auth. must resolve at boot
     networks:
       - mcnet
 
-  # Optional: backups
   mc-backup:
     image: itzg/mc-backup
     container_name: mc-backup
@@ -109,9 +107,69 @@ services:
     networks:
       - mcnet
 
+  # Internal ingress. Routes every vhost by Host header (conf.d/*.caddy):
+  #   auth. -> drasl, pack. -> packwiz files, apex -> landing + /launcher,
+  #   avatar. -> nmsr, status. -> uptime-kuma, distribution. -> static site.
+  # Published on a localhost-only port; the host's nginx terminates TLS in
+  # front of it (nginx/ulicraft-caddy.conf.tmpl).
+  caddy:
+    image: caddy:alpine
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "${CADDY_HTTP_BIND:-127.0.0.1}:${CADDY_HTTP_PORT:-8880}:80"
+    environment:
+      BASE_DOMAIN: ${BASE_DOMAIN}
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./caddy/conf.d/00-core.caddy:/etc/caddy/conf.d/00-core.caddy:ro
+      - ./caddy/conf.d/10-static.caddy:/etc/caddy/conf.d/10-static.caddy:ro
+      - ./caddy/conf.d/30-distribution.caddy:/etc/caddy/conf.d/30-distribution.caddy:ro
+      - ./caddy/conf.d/40-avatar.caddy:/etc/caddy/conf.d/40-avatar.caddy:ro
+      - ./caddy/conf.d/50-status.caddy:/etc/caddy/conf.d/50-status.caddy:ro
+      - ./www:/srv/www:ro
+      - ./launcher:/srv/launcher:ro
+      - ./pack:/srv/pack:ro
+      # Custom (locally-hosted) mod jars live OUTSIDE ./pack so packwiz refresh
+      # doesn't index them as direct files. Served at pack.${BASE_DOMAIN}/custom/.
+      - ./custom:/srv/pack/custom:ro
+      # Static site from ANOTHER repo (absolute host path in .env).
+      - ${DISTRIBUTION_WEB_ROOT:?DISTRIBUTION_WEB_ROOT unset in .env}:/srv/distribution:ro
+    networks:
+      mcnet:
+        # Containers resolve the stack's own public names to caddy internally.
+        aliases:
+          - "auth.${BASE_DOMAIN}"
+          - "pack.${BASE_DOMAIN}"
+
+  # Avatar/skin renderer — built from source (docker/nmsr/Dockerfile), pulls
+  # player profiles from Drasl over mcnet. caddy proxies avatar. -> nmsr:8080.
+  nmsr:
+    build:
+      context: ./docker/nmsr
+    image: ulicraft/nmsr:local
+    container_name: nmsr
+    restart: unless-stopped
+    volumes:
+      - ./nmsr/config.toml:/nmsr/config.toml:ro
+    networks:
+      - mcnet
+
+  # Status monitoring + public status page. caddy proxies status. -> :3001.
+  # Joins mcnet so monitors probe the stack by internal service name.
+  uptime-kuma:
+    image: louislam/uptime-kuma:1
+    container_name: uptime-kuma
+    restart: unless-stopped
+    volumes:
+      - kuma_data:/app/data
+    networks:
+      - mcnet
+
 volumes:
   drasl_state:
   mc_data:
+  kuma_data:
 
 networks:
   mcnet: