Pi stack behind Nginx Proxy Manager: remove Caddy and cert-sync (D-120)

The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST,
NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not
icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only
fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant
SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080,
then through NPM. The cert-sync image leaves the workflow and build-images.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/compose.yaml

@@ -1,7 +1,8 @@
 # Kvitt production stack on the Kvitt Pi (SPEC §10.2). Deployed by install.sh to /opt/kvitt/compose.yaml together
-# with /opt/kvitt/Caddyfile and /opt/kvitt/.env (from .env.example). Run every command from /opt/kvitt.
-# Only caddy publishes a port (8443); the server, Caddy's admin API and the sidecars are reachable only on the
-# internal network `kvitt` (SPEC §8.9).
+# with /opt/kvitt/.env (from .env.example). Run every command from /opt/kvitt.
+# TLS terminates in Nginx Proxy Manager on the Home Assistant Pi (SPEC §10.5, D-120), which forwards plain HTTP over
+# the LAN to the server's published port 8080. Only the server publishes a port; backup is reachable only on the
+# internal network `kvitt` (SPEC §8.9). The router forwards the internet only to NPM, never to this Pi.
 # Image names: ${KVITT_REGISTRY}/kvitt-<name>, the names the Gitea Actions workflow pushes (D-104).
 
 name: kvitt
@@ -13,49 +14,6 @@ x-logging: &logging
     max-file: "3"
 
 services:
-  caddy:
-    # Official image, pinned by version and multi-arch index digest (resolved 2026-10-18, infra/README.md).
-    image: docker.io/library/caddy:2.11.7@sha256:685ae3d7c34d9b5f8caeddc5d14051db7bbd88ff1f5a2fa0c16bd8ca328fb7af
-    restart: unless-stopped
-    # Non-root (D-117): uid 10002, plus group 1000 (cert-sync's group) to read the 0640 files in the 0750 /certs.
-    # 8443 needs no capability, but the image's /usr/bin/caddy carries the file capability cap_net_bind_service=ep,
-    # and the kernel refuses to exec it when that capability is not in the bounding set (checked 2026-10-18:
-    # "exec container process /usr/bin/caddy: Operation not permitted" with cap_drop ALL alone). So NET_BIND_SERVICE
-    # is the one capability kept. caddy_data (/data) is owned by 10002 (install.sh); /config (autosave of the loaded
-    # config) and /tmp are tmpfs, the rest of the root filesystem is read-only.
-    user: "10002:10002"
-    group_add: ["1000"]
-    read_only: true
-    cap_drop: [ALL]
-    cap_add: [NET_BIND_SERVICE]
-    security_opt:
-      - no-new-privileges:true
-    tmpfs:
-      - /config
-      - /tmp
-    mem_limit: 64m
-    ports:
-      - "8443:8443"
-    environment:
-      TZ: Europe/Stockholm
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - certs:/certs:ro
-      - caddy_data:/data
-    depends_on:
-      cert-sync:
-        condition: service_healthy
-      server:
-        condition: service_started
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:2019/config/ >/dev/null"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    logging: *logging
-    networks: [kvitt]
-
   server:
     image: ${KVITT_REGISTRY:?set KVITT_REGISTRY in .env}/kvitt-server:${KVITT_TAG:?set KVITT_TAG in .env}
     command: ["serve"]
@@ -66,11 +24,17 @@ services:
     security_opt:
       - no-new-privileges:true
     mem_limit: 160m
+    # On all interfaces of the Pi: NPM on the Home Assistant Pi connects to <KVITT_PI_HOST>:8080 over the LAN.
+    ports:
+      - "8080:8080"
     environment:
       TZ: Europe/Stockholm
-      # The remaining server settings keep their SPEC §10.4 defaults (KVITT_PUBLIC_URL
-      # https://icehack.asuscomm.com:8443, KVITT_TRUSTED_PROXY caddy, KVITT_FCM_PROJECT_ID kvitt-1337, ...).
       KVITT_DATA_DIR: /data
+      KVITT_PUBLIC_URL: https://${KVITT_PUBLIC_HOST:?set KVITT_PUBLIC_HOST in .env}:8443
+      # NPM's LAN address: only a request whose TCP peer is this address may set X-Forwarded-For, whose last entry
+      # is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IP literal (install.sh checks it).
+      KVITT_TRUSTED_PROXY: ${HA_HOST:?set HA_HOST in .env}
+      # The remaining server settings keep their SPEC §10.4 defaults (KVITT_FCM_PROJECT_ID kvitt-1337, ...).
     volumes:
       - data:/data
       - /opt/kvitt/secrets/fcm-service-account.json:/secrets/fcm-service-account.json:ro
@@ -85,34 +49,6 @@ services:
     logging: *logging
     networks: [kvitt]
 
-  cert-sync:
-    image: ${KVITT_REGISTRY}/kvitt-cert-sync:${KVITT_TAG}
-    restart: unless-stopped
-    user: "1000:1000"
-    cap_drop: [ALL]
-    security_opt:
-      - no-new-privileges:true
-    mem_limit: 32m
-    environment:
-      TZ: Europe/Stockholm
-      HA_HOST: ${HA_HOST:?set HA_HOST in .env}
-      HA_PORT: ${HA_PORT:-22}
-      HA_USER: ${HA_USER:?set HA_USER in .env}
-      HA_CERT_DIR: ${HA_CERT_DIR:?set HA_CERT_DIR in .env}
-    volumes:
-      - certs:/certs
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - /opt/kvitt/secrets/ha_ssh_key:/secrets/ha_ssh_key:ro
-      - /opt/kvitt/secrets/ha_known_hosts:/secrets/known_hosts:ro
-    healthcheck:
-      test: ["CMD-SHELL", "test -s /certs/fullchain.pem && test -s /certs/privkey.pem"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 60s
-    logging: *logging
-    networks: [kvitt]
-
   backup:
     image: ${KVITT_REGISTRY}/kvitt-backup:${KVITT_TAG}
     restart: unless-stopped
@@ -142,8 +78,6 @@ services:
 
 volumes:
   data:
-  certs:
-  caddy_data:
   backups:
 
 networks: