feat(caddy): add tls internal vhosts for upstream mirror hosts

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -35,7 +35,7 @@ services:
     restart: unless-stopped
     ports:
       - "80:80"
-      # - "443:443"            # future TLS (step-ca), deferred
+      - "443:443"              # tls internal — air-gap mirror vhosts (see 11)
     environment:
       BASE_DOMAIN: ${BASE_DOMAIN}
     volumes:
@@ -43,11 +43,19 @@ services:
       - ./www:/srv/www:ro
       - ./pack:/srv/pack:ro
       - ./mirror/launcher:/srv/www/launcher:ro
+      - ./mirror/upstream:/srv/mirror:ro   # byte-exact upstream mirror (see 11)
     networks:
       mcnet:
         aliases:
           - "auth.${BASE_DOMAIN}"
           - "packwiz.${BASE_DOMAIN}"
+          # Air-gap spoof hosts -> Caddy, so internal containers resolve them too.
+          - "meta.prismlauncher.org"
+          - "piston-meta.mojang.com"
+          - "piston-data.mojang.com"
+          - "libraries.minecraft.net"
+          - "maven.neoforged.net"
+          - "resources.download.minecraft.net"
 
   drasl:
     image: unmojang/drasl:latest