refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/14-deploy.md

@@ -7,9 +7,10 @@ Production host for the Ulicraft stack.
 | Host | `cochi` (SSH alias) |
 | Path | `/home/ubuntu/mc/ulicraft-server-v1` |
 | Branch | `main` |
-| Run mode | `online` (compose files: `docker-compose.yml` + `docker-compose.static.yml`) |
-| Auth | Drasl (base stack — no Blessing Skin override) |
-| Restart | **hard** (`compose down` → `build-stack.sh --up`) — brief full downtime |
+| Compose | single `docker-compose.yml` (no overrides) |
+| Auth | Drasl (password login) |
+| Ingress | host nginx (Let's Encrypt TLS) → caddy → services (see 15-letsencrypt.md) |
+| Restart | **hard** (`compose down` → `compose up --build`) — brief full downtime |
 
 ## Routine redeploy
 
@@ -17,9 +18,9 @@ Production host for the Ulicraft stack.
 ssh cochi
 cd /home/ubuntu/mc/ulicraft-server-v1
 git pull --ff-only
-# hard restart: tear the stack down, then bring it back up (renders configs first)
-docker compose -f docker-compose.yml -f docker-compose.static.yml down --remove-orphans
-tooling/build-stack.sh --up online
+tooling/render-config.sh        # re-render drasl/nmsr/pack configs from .env
+docker compose down --remove-orphans
+docker compose up -d --build
 ```
 
 Or as a one-shot from your workstation:
@@ -28,19 +29,20 @@ Or as a one-shot from your workstation:
 ssh cochi 'set -e
   cd /home/ubuntu/mc/ulicraft-server-v1
   git pull --ff-only
-  docker compose -f docker-compose.yml -f docker-compose.static.yml down --remove-orphans
-  tooling/build-stack.sh --up online'
+  tooling/render-config.sh
+  docker compose down --remove-orphans
+  docker compose up -d --build'
 ```
 
-`build-stack.sh --up online` runs preflight (checks `.env`), `render-config.sh`
-(which renders configs + `render-pack.sh` for the packwiz pack), then
-`docker compose ... up -d` with the online file set.
+`render-config.sh` re-renders configs (and `render-pack.sh` for the packwiz
+pack) from `.env` before the stack comes back up.
 
 ## What survives a hard restart
 
 Named volumes persist — world and auth data are safe:
 - `mc_data` — world + installed NeoForge/mods
 - `drasl_state` — Drasl accounts/skins
+- `kuma_data` — Uptime Kuma config/history
 - `backups/` — mc-backup snapshots
 
 `down` removes **containers**, not volumes. Players are disconnected during the
@@ -49,22 +51,20 @@ restart (a few minutes); they reconnect once `minecraft` is healthy again.
 ## Prerequisites (one-time, on `cochi`)
 
 - SSH access as the `cochi` alias.
-- `.env` present and complete: `BASE_DOMAIN`, `HOST_LAN_IP`, `RCON_PASSWORD`
-  (`render-config.sh` halts on any unset var, even in online mode).
+- `.env` present and complete: `BASE_DOMAIN`, `RCON_PASSWORD`, `CADDY_HTTP_PORT`,
+  `CADDY_HTTP_BIND`, `DISTRIBUTION_WEB_ROOT`, and the Let's Encrypt block
+  (`render-config.sh` halts on an unset `BASE_DOMAIN`).
 - Docker + compose plugin, `packwiz`, `envsubst`, `git`.
-- **First deploy only** — heavy online prep (fetch launcher, pre-bake the server
-  volume, etc.):
-  ```bash
-  tooling/build-stack.sh --prep
-  ```
-  Not needed for routine redeploys; `--up` alone re-syncs the pack and configs.
+- Host nginx + Let's Encrypt certs installed once — see `15-letsencrypt.md`.
+- **First deploy only** — online prep (build landing, fetch launcher, fetch
+  authlib into `runtime/`). Not needed for routine redeploys.
 
 ## Verify
 
 ```bash
-docker compose -f docker-compose.yml -f docker-compose.static.yml ps
-docker compose -f docker-compose.yml -f docker-compose.static.yml logs -f minecraft   # watch for "Done"
-curl -fsS "http://auth.$(grep '^BASE_DOMAIN=' .env | cut -d= -f2)/" >/dev/null && echo "auth ok"
+docker compose ps      # caddy, drasl, minecraft, mc-backup, nmsr, uptime-kuma up
+docker compose logs -f minecraft   # watch for "Done"
+curl -fsS "https://auth.$(grep '^BASE_DOMAIN=' .env | cut -d= -f2)/" >/dev/null && echo "auth ok"
 ```
 
 ## Rollback
@@ -72,15 +72,14 @@ curl -fsS "http://auth.$(grep '^BASE_DOMAIN=' .env | cut -d= -f2)/" >/dev/null &
 ```bash
 git log --oneline -5            # find the last-good commit
 git checkout <sha>              # or: git reset --hard <sha>
-docker compose -f docker-compose.yml -f docker-compose.static.yml down --remove-orphans
-tooling/build-stack.sh --up online
+docker compose down --remove-orphans
+docker compose up -d --build
 ```
 
 ## Notes
 
-- **Online mode needs internet** on `cochi` at restart (no air-gap mirror): the
-  server installs NeoForge + mods over the network. For an internet-less deploy,
-  switch to `airgap` (needs `--prep` first) — see `plan/13-dns-and-run-modes.md`.
-- Switching to the **Blessing Skin** auth variant changes the file set to
-  `-f docker-compose.yml -f docker-compose.blessingskin.yml` (see
-  `plan/03b-blessing-skin.md`); update the `down`/`up` commands accordingly.
+- Production needs internet on `cochi` at restart: the server installs/re-syncs
+  NeoForge + mods over the network.
+- All ingress goes through host nginx → caddy. After a redeploy, nginx config is
+  unchanged; only re-run `tooling/render-nginx.sh --install` if `BASE_DOMAIN` /
+  `CADDY_HTTP_PORT` changed (see `15-letsencrypt.md`).