Compose: make Caddy the default TLS front end (TTX/EBS parity)

[richardmhope]

Summary

• Caddy moves from the opt-in --profile tls to the default docker compose up path, matching the sibling IcebergTTX/EBS stacks — it publishes the only public ports (:80/:443, +443/udp HTTP/3) with automatic HTTPS (local CA for localhost, Let's Encrypt for a real ICEBERG_DOMAIN); the app's plain-HTTP :8000 stays published on loopback only as a local/debug side door (docker-compose hardcodes ICEBERG_ENVIRONMENT=dev, overriding .env — the documented TLS/production path silently keeps the dev-login bypass enabled #163 invariant unchanged).
• Hardening mirrors TTX: one-shot caddy-init chowns the cert/config volumes so caddy runs non-root (uid 1000) with cap_drop: ALL + NET_BIND_SERVICE on a read-only rootfs; image pin moves caddy:2 → caddy:2-alpine.
• deploy/Caddyfile: upstream dial_timeout/response_header_timeout so a stalled app worker returns 502 instead of holding client connections open.
• Dependabot gains the docker-compose ecosystem (EBS parity) so the postgres/redis/caddy compose pins get update PRs — the docker ecosystem only reads Dockerfile FROM lines.
• README quick start, TLS section, and deployment topologies updated (former topologies 2 and 3 merge).

Testing

• tests/test_prod_hardening.py::test_compose_prod_overrides_and_loopback_port drops the profile flag and now asserts the caddy service's port/user/capability/dependency invariants — passes.
• Booted the full stack locally: caddy-init runs and exits, caddy starts after the app is healthy; http://localhost/ → 308 → https://localhost/, portal login renders over TLS, /healthz 200 through the proxy. The read-only-rootfs "failed to install root certificate" log line is expected (Caddy trying to trust its own CA inside the container), same as TTX.

🤖 Generated with Claude Code

[icebergai-review-bot]

IcebergAutoReview

Verdict: approve

The clean, single-commit change correctly makes hardened Caddy the default TLS frontend while preserving loopback-only app access. Documentation, Dependabot configuration, Caddy timeouts, Compose dependencies, ports, capabilities, and tests are consistent. No blocking correctness or security issues found.

Findings

• No blocking findings.

Validation

• Reviewed complete main...HEAD diff and affected deployment context.
• Verified clean ancestry and scope against main.
• git diff --check main...HEAD passed.
• Targeted pytest could not start because local dependencies are unavailable (FastAPI missing); uv also could not create an environment on the read-only workspace. Current-head GitHub CI is green.

Residual risks / optional notes

• The complete non-root Caddy startup path is supported by the reported manual stack test but is not exercised by PR CI beyond resolved Compose configuration assertions.

Automated review by Codex 872d986f6445 using IcebergAutoReview.