Add reverse proxy SSL guides for Caddy, Nginx, and Traefik.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/caddy/Caddyfile

@@ -0,0 +1,28 @@
+{$DOMAIN:panel.example.com} {
+	encode gzip zstd
+
+	# Healthcheck без редиректов наружу
+	handle /health {
+		reverse_proxy app:8080
+	}
+
+	reverse_proxy app:8080 {
+		header_up X-Real-IP {remote_host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up Host {host}
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		X-Content-Type-Options nosniff
+		X-Frame-Options DENY
+		Referrer-Policy strict-origin-when-cross-origin
+		-Server
+	}
+
+	log {
+		output stdout
+		format console
+	}
+}

deploy/caddy/docker-compose.caddy.yml

@@ -0,0 +1,38 @@
+# Пример: Caddy как reverse proxy с авто-SSL (Let's Encrypt)
+#
+# Запуск вместе с панелью:
+#   docker compose -f docker-compose.yml -f deploy/caddy/docker-compose.caddy.yml up -d --build
+#
+# Перед стартом:
+#   1. DNS A/AAAA домена → IP сервера
+#   2. Открыты порты 80 и 443
+#   3. В .env задайте DOMAIN=panel.example.com
+#   4. В docker-compose панели лучше НЕ публиковать 8080 наружу (или оставить только localhost)
+
+services:
+  caddy:
+    image: caddy:2-alpine
+    container_name: vpn-panel-caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"
+    environment:
+      DOMAIN: ${DOMAIN:-panel.example.com}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - vpn-net
+    depends_on:
+      - app
+
+volumes:
+  caddy_data:
+  caddy_config:
+
+networks:
+  vpn-net:
+    name: vpn-panel-net