add caddy2 config example

deploy/Caddyfile.example

@@ -0,0 +1,48 @@
+# Adventure Land behind Caddy 2
+#
+# Replace before use:
+#   al.example.com  -> public hostname (DNS A/AAAA must point at the Caddy host)
+#   10.10.16.28     -> LAN/VPN address of the Docker host running the stack
+#
+# Caddy gets/renews the certificate automatically; TCP 80 and 443 must reach
+# the Caddy host. For an internal-only name use `tls internal` instead.
+{
+	# email you@example.com
+}
+
+al.example.com {
+	encode zstd gzip
+
+	# --- Game server (container port 7192) ------------------------------
+	# /socket.io/         browser <-> game (WebSocket)
+	# /socket.io-msgpack/ alternate parser used by the msgpack client
+	# /server.api/        backend -> game (server_eval, protected by ACCESS_MASTER)
+	@game path /socket.io/* /socket.io-msgpack/* /server.api/*
+	handle @game {
+		reverse_proxy 10.10.16.28:7192
+	}
+
+	# --- Web backend (container port 8090) ------------------------------
+	# Everything else: HTML, JS, /api/*, static files.
+	handle {
+		reverse_proxy 10.10.16.28:8090 {
+			# Keep the public Host: the backend derives base_url and the
+			# auth cookie domain from it.
+			header_up Host {host}
+		}
+	}
+
+	# Internal-only TLS (no Let's Encrypt). Clients must trust Caddy's CA.
+	# tls internal
+
+	# Optional hardening: only the Docker host may call the game's server API.
+	# When enabling this, remove /server.api/* from the @game matcher above.
+	# @serverapi {
+	# 	path /server.api/*
+	# 	remote_ip 10.10.16.28
+	# }
+	# handle @serverapi {
+	# 	reverse_proxy 10.10.16.28:7192
+	# }
+}
+}