deploy: add Docker and Caddy production stack

compose.yaml

@@ -0,0 +1,61 @@
+name: minabot
+services:
+  app:
+    image: ${APP_IMAGE:?Set APP_IMAGE to the tested release image}
+    env_file:
+      - path: .env.production
+        format: raw
+    volumes:
+      - /srv/minabot/data:/data
+    restart: unless-stopped
+    init: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop: [ALL]
+    healthcheck:
+      test: [CMD, bun, -e, "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 10s
+      start_period: 60s
+      retries: 3
+    logging:
+      driver: local
+      options:
+        max-size: 10m
+        max-file: "3"
+  caddy:
+    image: ${CADDY_IMAGE:?Set CADDY_IMAGE to a pinned image digest}
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    restart: unless-stopped
+    depends_on:
+      app:
+        condition: service_healthy
+    logging:
+      driver: local
+      options:
+        max-size: 10m
+        max-file: "3"
+  monitor:
+    image: ${APP_IMAGE:?Set APP_IMAGE to the tested release image}
+    command: [bun, scripts/monitor.ts]
+    environment:
+      MONITOR_URL: https://mina.teppelinlabs.com/api/health
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop: [ALL]
+    read_only: true
+    logging:
+      driver: local
+      options:
+        max-size: 10m
+        max-file: "3"
+volumes:
+  caddy_data:
+  caddy_config: