feat(deploy): add the reference deployment Compose project

Implement ADR 0044's reference deployment as a base Compose file plus
overlays, so an installation that already runs a proxy can use the base
alone.

- compose.yaml: api, postgres, object-storage, and the operator-only
  migrate (profile ops, plan by default). No published port. api and
  migrate run init, read-only, tmpfs /tmp, cap_drop ALL,
  no-new-privileges. postgres is only on the internal data network.
- TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3
  only, with pg_hba rejecting every non-TLS connection, and the API on
  verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3
  over HTTPS (ADR 0030 requires https in production), trusted by the
  API through NODE_EXTRA_CA_CERTS. No Core change.
- compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME
  HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/*
  to api and refuses everything else; the storage hostname preserves
  Host. The API trusts exactly the proxy's fixed /32 on an edge network
  whose dynamic range excludes the fixed addresses; Caddy overwrites
  X-Forwarded-For and strips caller-supplied forwarding headers.
- compose.tunnel.yaml: cloudflared pinned by digest, token from its own
  env file; Caddy honors CF-Connecting-IP only from its fixed address.
- Four per-service root-owned env files, examples with no values;
  scripts/init-tls.sh (idempotent, never overwrites a key) and
  scripts/gen-secrets.sh (prints only).
- CI: pnpm deploy:config in ci:verify for all three combinations, and a
  deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the
  Dashboard, signed storage delivery, the client-address chain, initial
  owner sign-in/out, verify-full database TLS, and Doctor through the
  proxy, against disposable services. tests/deploy.test.ts pins the
  structural guarantees.
- ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS,
  DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the
  tunnel's origin TLS settings live in the Cloudflare dashboard, port
  80 serves HTTP-01, and secrets are one env file per service.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/env/compose.env.example

@@ -0,0 +1,29 @@
+# Non-secret settings for the reference deployment's Compose project. Copy to deploy/.env, which
+# Compose reads automatically from this directory. Nothing here is a secret; secrets live in the
+# per-service files under EKKLESIA_ENV_DIR.
+
+# The image to run, by registry, name, and tag (or digest). Required.
+EKKLESIA_IMAGE=
+
+# Where the root-owned, mode-600 env files and the TLS directory live on the host.
+EKKLESIA_ENV_DIR=/etc/ekklesia
+EKKLESIA_TLS_DIR=/etc/ekklesia/tls
+
+# --- compose.proxy.yaml ---------------------------------------------------------------------------
+# The Ekklesia hostname (Dashboard, API, displays) and the storage hostname (signed object URLs).
+EKKLESIA_HOSTNAME=
+EKKLESIA_STORAGE_HOSTNAME=
+# Contact address for the ACME account (certificate expiry notices).
+EKKLESIA_ACME_EMAIL=
+# EKKLESIA_CADDYFILE=./Caddyfile
+# EKKLESIA_PUBLISH_ADDRESS=0.0.0.0
+# EKKLESIA_HTTP_PORT=80
+# EKKLESIA_HTTPS_PORT=443
+
+# The edge network. Change the subnet only if it collides with one already on the host. Docker
+# assigns dynamic addresses only from EKKLESIA_EDGE_DYNAMIC_RANGE (the lower half); the proxy and
+# the tunnel connector take fixed addresses from the upper half, so nothing else can ever hold them.
+# EKKLESIA_EDGE_SUBNET=10.249.250.0/24
+# EKKLESIA_EDGE_DYNAMIC_RANGE=10.249.250.0/25
+# EKKLESIA_PROXY_ADDRESS=10.249.250.254
+# EKKLESIA_TUNNEL_ADDRESS=10.249.250.253