chore: replace placeholder deploy config with actual production files

- deploy/compose.yaml: replace generated placeholder with actual monolith
  compose (Foundry, Caddy, media stack, famapp, Authentik, Watchtower, etc.)
- deploy/Caddyfile.snippet: replace with full production Caddyfile
- .env.production.example: update variable names to match production
  (famapp_MINIO_ROOT_USER/PASSWORD/BUCKET, CF_API_TOKEN, etc.)
- scripts/apply-compose.ps1: add -Compose/-Caddy flags; push Caddyfile
  and reload caddy in addition to compose restart

.env.production.example

@@ -1,24 +1,25 @@
 # ── famapp ────────────────────────────────────────────────────────────────────
+# These vars are consumed by the famapp service in docker-compose.yml.
+# The production .env lives on valhalla at ~/htpc-download-box/.env
 
 # Image tag to deploy. Pin to a specific version after first deploy
 # (e.g. ghcr.io/ginnoir/famapp:v0.1.0). `latest` is fine for staging/initial.
 FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
-# `always` pulls on every `up`; set `missing` if you want to skip pulls.
 FAMAPP_PULL_POLICY=always
-# Authentik image tag. Bump in lockstep with Authentik release notes.
 AUTHENTIK_IMAGE_TAG=2024.12.3
-# Run drizzle migrations on container start. Leave true.
 RUN_MIGRATIONS=true
 
-# Public URL for the app — used by Auth.js for OIDC redirect URIs.
+# Public URL for the app
 AUTH_URL=https://fam.ginnoir.com
 
-# famapp Postgres credentials (used to build DATABASE_URL inside compose.yaml)
+# famapp Postgres
 FAMAPP_DB_USER=famapp
 FAMAPP_DB_PASSWORD=replace-with-strong-password
 FAMAPP_DB_NAME=famapp
 
 # Auth.js session secret — generate with: openssl rand -base64 32
+# NOTE: the monolith .env also uses AUTH_SECRET for Reactive Resume.
+# Docker Compose uses the last occurrence. Keep famapp's entry last.
 AUTH_SECRET=replace-with-openssl-rand-base64-32
 
 # OIDC provider (Authentik) — fill in after bootstrapping Authentik
@@ -26,26 +27,32 @@ AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
 AUTH_OIDC_CLIENT_ID=replace-me
 AUTH_OIDC_CLIENT_SECRET=replace-me
 
-# Web Push VAPID keys — generate with: pnpm vapid:generate (run from the repo)
+# Web Push VAPID keys — generate with: pnpm vapid:generate
 VAPID_PUBLIC_KEY=
 VAPID_PRIVATE_KEY=
-# Must be "mailto:<address>" or a URL
+VAPID_SUBJECT=mailto:your-email@example.com
-VAPID_SUBJECT=mailto:3nigma.matt@gmail.com
 
-# ntfy push fallback — uses your existing ntfy instance at ntfy.ginnoir.com
+# ntfy push fallback
-# Leave NTFY_URL blank to disable ntfy fanout.
 NTFY_URL=https://ntfy.ginnoir.com
 NTFY_TOPIC=famapp
 
 # Log level: error | warn | info | debug
 LOG_LEVEL=info
 
-# ── Authentik ─────────────────────────────────────────────────────────────────
+# MinIO object storage (garden image uploads)
+famapp_MINIO_ROOT_USER=famapp
+famapp_MINIO_ROOT_PASSWORD=replace-with-strong-password
+famapp_MINIO_BUCKET=garden
 
-# Authentik Postgres credentials (separate DB per Matt's rule)
+# OpenPlantBook API (optional — used for plant species lookup)
+famapp_OPENPLANTBOOK_CLIENT_ID=
+famapp_OPENPLANTBOOK_CLIENT_SECRET=
+
+# ── Authentik ─────────────────────────────────────────────────────────────────
 AUTHENTIK_DB_USER=authentik
 AUTHENTIK_DB_PASSWORD=replace-with-strong-password
 AUTHENTIK_DB_NAME=authentik
-
-# Authentik secret key — generate with: openssl rand -base64 60
 AUTHENTIK_SECRET_KEY=replace-with-openssl-rand-base64-60
+
+# ── Cloudflare (Caddy DNS-01 TLS) ─────────────────────────────────────────────
+CF_API_TOKEN=replace-with-cloudflare-api-token

deploy/Caddyfile.snippet

@@ -1,10 +1,225 @@
-# famapp — paste into your existing Caddyfile.
+# =============================================================
-# famapp runs on 3010, authentik-server on 9200 (both bound to the host by deploy/compose.yaml).
+# GLOBAL OPTIONS
+# =============================================================
+{
+	acme_dns cloudflare {env.CF_API_TOKEN}
+}
 
+# =============================================================
+# SNIPPETS
+# =============================================================
+# Reusable matcher — blocks anything not on the LAN.
+# Usage: import internal_only inside any site block.
+(internal_only) {
+	@blocked not remote_ip 192.168.1.0/24
+	respond @blocked "Access denied" 403
+}
+
+# =============================================================
+# FOUNDRY VTT — public
+# =============================================================
+foundry.ginnoir.com {
+	reverse_proxy foundry:30000
+}
+
+foundry2.ginnoir.com {
+	reverse_proxy foundry2:30000
+}
+
+# =============================================================
+# TABLETOP TOOLS — public
+# =============================================================
+5etools.ginnoir.com {
+	reverse_proxy 5etools:80
+}
+
+pf2e.ginnoir.com {
+	root * /srv/aon
+	file_server
+}
+
+# =============================================================
+# FILE STORAGE — public
+# =============================================================
+files.ginnoir.com {
+	reverse_proxy owncloud:8080
+}
+
+# =============================================================
+# STATIC SITES — public
+# =============================================================
+ffttsystems.ginnoir.com {
+	root * /srv/ffttsystems
+	file_server
+}
+
+# =============================================================
+# MEDIA REQUESTS — public
+# =============================================================
+requests.ginnoir.com {
+	reverse_proxy overseerr:5055
+}
+
+# =============================================================
+# MEDIA MANAGEMENT — internal only
+# =============================================================
+sonarr.ginnoir.com {
+	import internal_only
+	reverse_proxy sonarr:8989
+}
+
+radarr.ginnoir.com {
+	import internal_only
+	reverse_proxy radarr:7878
+}
+
+bazarr.ginnoir.com {
+	import internal_only
+	reverse_proxy bazarr:6767
+}
+
+jackett.ginnoir.com {
+	import internal_only
+	reverse_proxy jackett:9117
+}
+
+prowlarr.ginnoir.com {
+	import internal_only
+	reverse_proxy prowlarr:9696
+}
+
+tautulli.ginnoir.com {
+	import internal_only
+	reverse_proxy tautulli:8181
+}
+
+hydra.ginnoir.com {
+	import internal_only
+	reverse_proxy nzbhydra2:5076
+}
+
+# =============================================================
+# DOWNLOAD CLIENTS — internal only
+# =============================================================
+qbittorrent.ginnoir.com {
+	import internal_only
+	reverse_proxy qbittorrent:3232
+}
+
+deluge.ginnoir.com {
+	import internal_only
+	reverse_proxy deluge:8112
+}
+
+nzbget.ginnoir.com {
+	import internal_only
+	reverse_proxy nzbget:6789
+}
+
+whisparr.ginnoir.com {
+	import internal_only
+	reverse_proxy whisparr:6969
+}
+
+stash.ginnoir.com {
+	import internal_only
+	reverse_proxy stash:6970
+}
+
+# =============================================================
+# NOTIFICATIONS & RSS — public
+# =============================================================
+ntfy.ginnoir.com, http://ntfy.ginnoir.com {
+	reverse_proxy ntfy:80
+	@httpget {
+		protocol http
+		method GET
+		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
+	}
+	redir @httpget https://{host}{uri}
+}
+
+freshrss.ginnoir.com {
+	reverse_proxy freshrss:80
+	@httpget {
+		protocol http
+		method GET
+		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
+	}
+	redir @httpget https://{host}{uri}
+}
+
+# =============================================================
+# RESUME / PORTFOLIO — public
+# =============================================================
+resume.ginnoir.com, https://resume.ginnoir.com {
+	reverse_proxy app:3000
+	@httpget {
+		protocol http
+		method GET
+		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
+	}
+	redir @httpget https://{host}{uri}
+}
+
+j-costa.com, https://j-costa.com {
+	tls {
+            issuer acme {
+                disable_tlsalpn_challenge
+            }
+	}
+	redir * https://resume.ginnoir.com/ginnoir/resume permanent
+}
+
+storage.j-costa.com, https://storage.j-costa.com {
+	tls {
+            issuer acme {
+                disable_tlsalpn_challenge
+            }
+	}
+	reverse_proxy resume-minio:9000
+	@httpget {
+		protocol http
+		method GET
+		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
+	}
+	redir @httpget https://{host}{uri}
+}
+
+# =============================================================
+# MINIO CONSOLE — internal only
+# =============================================================
+minio.ginnoir.com {
+	import internal_only
+	reverse_proxy resume-minio:9001
+}
+
+# =============================================================
+# MATRIX — public
+# =============================================================
+ginnoir.com {
+	header /.well-known/matrix/* Content-Type application/json
+	header /.well-known/matrix/* Access-Control-Allow-Origin *
+	respond /.well-known/matrix/server `{"m.server": "matrix.ginnoir.com:443"}`
+	respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://matrix.ginnoir.com"},"m.identity_server":{"base_url":"https://identity.ginnoir.com"}}`
+}
+
+matrix.ginnoir.com {
+	reverse_proxy /_matrix/* localhost:8008
+	reverse_proxy /_synapse/client/* localhost:8008
+}
+
+# =============================================================
+# FAMAPP & AUTH — public
+# =============================================================
 fam.ginnoir.com {
-    reverse_proxy 192.168.1.69:3010
+	reverse_proxy famapp:3000
 }
 
 auth.ginnoir.com {
-    reverse_proxy 192.168.1.69:9200
+	reverse_proxy authentik-server:9000
+}
+
+dev.ginnoir.com {
+       reverse_proxy 192.168.1.74:3000
 }