refactor: switch nginx to Caddy with automatic Let's Encrypt

Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.

- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
  `import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
  matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
  unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -1,25 +1,26 @@
 #!/usr/bin/env bash
-# proxy-vm/scripts/deploy.sh
-# Pull latest changes and redeploy containers.
+# elevenlabs.io/scripts/deploy.sh
+# Pull the latest image built by Gitea Actions and restart the proxy.
 set -euo pipefail
 
-PROXY_DIR="/opt/proxy/proxy-vm"
+PROXY_DIR="${PROXY_DIR:-/srv/elevenlabs}"
 cd "${PROXY_DIR}"
 
-echo "=== [1/5] Pulling latest code ==="
-git -C "$(dirname "${PROXY_DIR}")" pull
+COMPOSE="docker-compose"
+command -v docker-compose >/dev/null 2>&1 || COMPOSE="docker compose"
 
-echo "=== [2/5] Building container ==="
-docker compose build --no-cache
+echo "=== [1/4] Pulling latest image ==="
+${COMPOSE} pull
 
-echo "=== [3/5] Restarting containers ==="
-docker compose up -d --force-recreate
+echo "=== [2/4] Recreating container ==="
+${COMPOSE} up -d
 
-echo "=== [4/5] Container status ==="
-docker compose ps
+echo "=== [3/4] Status ==="
+${COMPOSE} ps
 
-echo "=== [5/5] Recent logs ==="
-docker compose logs --tail=20 proxy
+echo "=== [4/4] Recent logs ==="
+${COMPOSE} logs --tail=30 proxy
 
 echo ""
-echo "Deploy complete."
+echo "Health: curl -s http://localhost:8082/health"
+echo "TLS:    curl -s https://${DOMAIN:-proxy.bildme.ru}/health"

scripts/install.sh

@@ -3,7 +3,7 @@
 # Bootstrap script for fresh Ubuntu 24.04 VM.
 set -euo pipefail
 
-PROXY_DIR="/opt/proxy"
+PROXY_DIR="/srv/elevenlabs"
 REPO_URL="https://github.com/YOUR_ORG/YOUR_REPO.git"  # TODO: replace with actual repo
 
 echo "=== [1/6] Installing Docker and dependencies ==="
@@ -25,7 +25,7 @@ else
 fi
 
 echo "=== [5/6] Setting up .env ==="
-cd "${PROXY_DIR}/proxy-vm"
+cd "${PROXY_DIR}"
 if [ ! -f .env ]; then
     cp .env.example .env
     # Generate a random PROXY_SECRET
@@ -33,21 +33,21 @@ if [ ! -f .env ]; then
     sed -i "s/change-me-generate-with-openssl-rand-hex-32/${GENERATED_SECRET}/" .env
     echo ""
     echo ">>> .env created with auto-generated PROXY_SECRET"
-    echo ">>> Edit /opt/proxy/proxy-vm/.env to set ALLOWED_CIDR"
+    echo ">>> Edit ${PROXY_DIR}/.env to set DOMAIN, ACME_EMAIL and ALLOWED_CIDR"
     echo ""
 else
     echo ".env already exists, skipping..."
 fi
 
 echo "=== [6/6] Starting containers ==="
-docker compose up -d --build
+docker-compose up -d
 
 echo ""
 echo "=========================================="
-echo " Proxy is running on port 8080"
-echo " Health check: curl http://localhost:8080/health"
+echo " Proxy is running on ports 80/443 (HTTPS) and 8082 (plain HTTP)"
+echo " Health check: curl http://localhost:8082/health"
 echo ""
-echo " IMPORTANT: Edit ${PROXY_DIR}/proxy-vm/.env"
-echo "   - Set ALLOWED_CIDR to your k8s cluster CIDR"
-echo "   - Then run: docker compose restart"
+echo " IMPORTANT: Edit ${PROXY_DIR}/.env"
+echo "   - Set DOMAIN, ACME_EMAIL and ALLOWED_CIDR"
+echo "   - Then run: docker-compose up -d"
 echo "=========================================="

scripts/migrate-host-nginx.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# elevenlabs.io/scripts/migrate-host-nginx.sh
+# Frees ports 80/443 on the host so the Caddy container can obtain Let's Encrypt certs.
+# Backs up the whole host nginx configuration first, then stops and disables the service.
+set -euo pipefail
+
+BACKUP_DIR="/root/nginx-backup-$(date +%Y%m%d-%H%M%S)"
+
+if ! systemctl is-active --quiet nginx; then
+    echo "Host nginx is not running — nothing to migrate."
+    exit 0
+fi
+
+echo "=== [1/5] Dumping host nginx config to ${BACKUP_DIR} ==="
+mkdir -p "${BACKUP_DIR}"
+nginx -T > "${BACKUP_DIR}/nginx-T.dump" 2>&1 || true
+tar -czf "${BACKUP_DIR}/etc-nginx.tar.gz" /etc/nginx 2>/dev/null
+cp -a /etc/letsencrypt "${BACKUP_DIR}/letsencrypt" 2>/dev/null || true
+echo "Backup written."
+
+echo "=== [2/5] Virtual hosts currently served ==="
+grep -hE '^\s*server_name' "${BACKUP_DIR}/nginx-T.dump" | sed 's/^[ \t]*//' | sort -u
+
+read -r -p "Stop and disable host nginx? These vhosts will go offline [y/N] " answer
+case "${answer}" in
+    [yY]) ;;
+    *) echo "Aborted. Backup kept at ${BACKUP_DIR}"; exit 1 ;;
+esac
+
+echo "=== [3/5] Stopping nginx ==="
+systemctl disable --now nginx
+
+echo "=== [4/5] Certbot renewal hooks ==="
+# Certbot keeps trying to renew certs through the nginx plugin — it would fail now.
+systemctl disable --now certbot.timer 2>/dev/null || true
+echo "certbot.timer disabled (Caddy manages its own certificates)."
+
+echo "=== [5/5] Port check ==="
+ss -tlnp | grep -E ':(80|443)\s' && { echo "Ports 80/443 are still busy — inspect before starting Caddy."; exit 1; }
+echo "Ports 80 and 443 are free."
+echo ""
+echo "Backup: ${BACKUP_DIR}"
+echo "Next: cd /srv/elevenlabs && docker-compose pull && docker-compose up -d"