feat: add Caddy to Docker container — automatic HTTPS

- Caddy reverse proxies :80/:443 → Node :3000
- Mount custom Caddyfile for your domain → auto Let's Encrypt TLS
- Caddy certs persisted in /data/caddy volume
- Ports: 80 (HTTP), 443 (HTTPS), 1883 (MQTT)

Dockerfile

@@ -1,6 +1,6 @@
 FROM node:22-alpine
 
-RUN apk add --no-cache mosquitto mosquitto-clients supervisor
+RUN apk add --no-cache mosquitto mosquitto-clients supervisor caddy
 
 WORKDIR /app
 
@@ -12,12 +12,13 @@ RUN npm ci --production
 COPY server.js db.js packet-store.js config.example.json ./
 COPY public/ ./public/
 
-# Supervisor config
+# Supervisor + Mosquitto + Caddy config
 COPY docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY docker/mosquitto.conf /etc/mosquitto/mosquitto.conf
+COPY docker/Caddyfile /etc/caddy/Caddyfile
 
-# Create data directory for SQLite + Mosquitto persistence
-RUN mkdir -p /app/data /var/lib/mosquitto && \
+# Create data directory for SQLite + Mosquitto persistence + Caddy certs
+RUN mkdir -p /app/data /var/lib/mosquitto /data/caddy && \
     chown -R node:node /app/data && \
     chown -R mosquitto:mosquitto /var/lib/mosquitto
 
@@ -25,8 +26,8 @@ RUN mkdir -p /app/data /var/lib/mosquitto && \
 COPY docker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-EXPOSE 3000 1883
+EXPOSE 80 443 1883
 
-VOLUME ["/app/data"]
+VOLUME ["/app/data", "/data/caddy"]
 
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -77,13 +77,33 @@ The easiest way to run MeshCore Analyzer. Includes Mosquitto MQTT broker — eve
 docker build -t meshcore-analyzer .
 docker run -d \
   --name meshcore-analyzer \
-  -p 3000:3000 \
+  -p 80:80 \
+  -p 443:443 \
   -p 1883:1883 \
   -v meshcore-data:/app/data \
+  -v caddy-certs:/data/caddy \
   meshcore-analyzer
 ```
 
-Open `http://localhost:3000`. Point your MeshCore gateway's MQTT to `<host-ip>:1883`.
+Open `http://localhost`. Point your MeshCore gateway's MQTT to `<host-ip>:1883`.
+
+**With a domain (automatic HTTPS):**
+```bash
+# Create a Caddyfile with your domain
+echo 'analyzer.example.com { reverse_proxy localhost:3000 }' > Caddyfile
+
+docker run -d \
+  --name meshcore-analyzer \
+  -p 80:80 \
+  -p 443:443 \
+  -p 1883:1883 \
+  -v meshcore-data:/app/data \
+  -v caddy-certs:/data/caddy \
+  -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile \
+  meshcore-analyzer
+```
+
+Caddy automatically provisions Let's Encrypt TLS certificates.
 
 **Custom config:**
 ```bash

docker/Caddyfile

@@ -0,0 +1,11 @@
+# Default Caddyfile — reverse proxy to Node app
+# Override by mounting your own: -v ./Caddyfile:/etc/caddy/Caddyfile
+#
+# For automatic HTTPS, replace :80 with your domain:
+#   analyzer.example.com {
+#       reverse_proxy localhost:3000
+#   }
+
+:80 {
+    reverse_proxy localhost:3000
+}

docker/supervisord.conf

@@ -24,3 +24,12 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 environment=NODE_ENV="production"
+
+[program:caddy]
+command=/usr/sbin/caddy run --config /etc/caddy/Caddyfile
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0