feat: integrate Caddy as default SSL terminator and reverse proxy

- Add caddy:2-alpine service to docker-compose.quickstart.yml listening
  on https://localhost:4000 using Caddy's local CA
- Add caddy:2-alpine service to docker-compose.yml listening on ports 80/443
  with automatic HTTPS via Let's Encrypt for production
- Remove direct host port mappings from html2rss-web in both compose files
- Sanitize X-Forwarded-For and X-Real-IP headers using {client_ip} placeholder
  to prevent rate-limit bypass via IP spoofing
- Disable Caddy admin API by default (admin off) to reduce attack surface
- Support CADDY_GLOBAL_OPTIONS env var for CDN/load-balancer trusted_proxies config
- Update bin/quickstart-verify to assert port mapping on caddy service

Closes #1012

Author: gildesmarais

bin/quickstart-verify

@@ -52,13 +52,14 @@ end
 config = compose_config
 services = config.fetch('services') { abort('quickstart verify failed: missing top-level services map') }
 web = fetch_service!(services, 'html2rss-web')
+caddy = fetch_service!(services, 'caddy')
 fetch_service!(services, 'botasaurus')
 
 assert_equal!(web['image'], EXPECTED_WEB_IMAGE, 'html2rss-web image')
 environment = web.fetch('environment') { abort('quickstart verify failed: html2rss-web missing environment map') }
 assert_equal!(environment['RACK_ENV'], EXPECTED_RACK_ENV, 'html2rss-web RACK_ENV')
 assert_equal!(environment['HTML2RSS_ACCESS_TOKEN'], EXPECTED_ACCESS_TOKEN, 'html2rss-web HTML2RSS_ACCESS_TOKEN')
 assert_equal!(environment['BOTASAURUS_SCRAPER_URL'], EXPECTED_SCRAPER_URL, 'html2rss-web BOTASAURUS_SCRAPER_URL')
-assert_port_mapping!(web['ports'])
+assert_port_mapping!(caddy['ports'])
 
 puts 'quickstart verify passed'

docker-compose.quickstart.yml

@@ -1,12 +1,37 @@
 services:
-  html2rss-web:
-    image: ${HTML2RSS_WEB_IMAGE:-html2rss/web:1}
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
     ports:
       - "127.0.0.1:4000:4000"
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    command:
+      - sh
+      - -c
+      - |
+        echo "{
+            admin off
+            ${CADDY_GLOBAL_OPTIONS:-}
+        }
+        https://localhost:4000 {
+            reverse_proxy html2rss-web:4000 {
+                header_up X-Forwarded-For {client_ip}
+                header_up X-Real-IP {client_ip}
+            }
+        }" | caddy run --config - --adapter caddyfile
+
+  html2rss-web:
+    image: ${HTML2RSS_WEB_IMAGE:-html2rss/web:1}
     environment:
       RACK_ENV: development
       HTML2RSS_ACCESS_TOKEN: CHANGE_ME_ADMIN_TOKEN
       BOTASAURUS_SCRAPER_URL: http://botasaurus:4010
 
   botasaurus:
     image: html2rss/botasaurus-scrape-api:latest
+
+volumes:
+  caddy_data:
+  caddy_config:

docker-compose.yml

@@ -2,11 +2,33 @@
 # This is the default configuration - customize as needed
 
 services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    command:
+      - sh
+      - -c
+      - |
+        echo "{
+            admin off
+            ${CADDY_GLOBAL_OPTIONS:-}
+        }
+        https://${CADDY_HOST:-localhost} {
+            reverse_proxy html2rss-web:4000 {
+                header_up X-Forwarded-For {client_ip}
+                header_up X-Real-IP {client_ip}
+            }
+        }" | caddy run --config - --adapter caddyfile
+
   html2rss-web:
     image: html2rss/web
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:4000:4000"
     env_file:
       - path: .env
         required: false
@@ -48,3 +70,7 @@ services:
       PORT: 4002
       CONCURRENT: 10
       TOKEN: ${BROWSERLESS_IO_API_TOKEN:?set BROWSERLESS_IO_API_TOKEN}
+
+volumes:
+  caddy_data:
+  caddy_config: