feat: [#272] Add HTTPS support with Caddy for all HTTP services

[josecelano]

Summary

Add HTTPS support with Caddy reverse proxy for automatic TLS termination on all HTTP services (Tracker API, HTTP Trackers, Grafana).

Closes #272

What's Implemented

Phase 1: Template Creation ✅

• Created templates/caddy/Caddyfile.tera with conditional service blocks
• Created docs/contributing/templates/caddy.md documenting template variables
• Updated templates/docker-compose/docker-compose.yml.tera with Caddy service block
• Registered templates in CaddyProjectGenerator with 14 unit tests

Phase 2: Configuration DTOs ✅

• Added HttpsSection DTO with admin_email and use_staging fields
• Added TlsSection DTO with domain field for service-specific TLS
• Extended HttpApiSection, HttpTrackerSection, GrafanaSection with optional tls
• Implemented validation (has_any_tls_configured, https/tls consistency)
• Added Email type in src/shared/email.rs for email format validation
• Added DomainName type in src/shared/domain_name.rs for domain validation

Phase 3: Template Rendering Integration ✅

• Created RenderCaddyTemplatesStep for template rendering
• Created DeployCaddyConfigStep for Ansible deployment
• Created deploy-caddy-config.yml Ansible playbook
• Added RenderCaddyTemplates and DeployCaddyConfigToRemote to ReleaseStep enum
• Integrated CaddyContext into Docker Compose template rendering
• Added CaddyConfigDeployment error variant with actionable help text

Phase 6: E2E Testing (Partial) ✅

Manual E2E testing verified:

• ✅ HTTPS endpoints working for API, Grafana, and HTTP trackers
• ✅ HTTP→HTTPS redirect (308 Permanent Redirect)
• ✅ HTTP/2 and HTTP/3 enabled
• ✅ Caddy Local CA for .local domains

What's Remaining (Work in Progress)

• Phase 4: Security workflow updates (add Caddy to Docker security scans)
• Phase 5: Documentation (create docs/user-guide/https-setup.md)
• Phase 6: Automated E2E tests (currently only manual testing)
• Phase 7: Schema generation (regenerate JSON schema with HTTPS config)
• Phase 8: Create ADR documenting Caddy adoption decision

Configuration Example

{
  "https": {
    "admin_email": "admin@example.com",
    "use_staging": true
  },
  "tracker": {
    "http_api": {
      "bind_address": "0.0.0.0:1212",
      "admin_token": "secret",
      "tls": {
        "domain": "api.tracker.local"
      }
    },
    "http_trackers": [
      {
        "bind_address": "0.0.0.0:7070",
        "tls": {
          "domain": "http1.tracker.local"
        }
      }
    ]
  },
  "grafana": {
    "admin_user": "admin",
    "admin_password": "admin",
    "tls": {
      "domain": "grafana.tracker.local"
    }
  }
}

Testing

• All pre-commit checks pass
• Manual E2E test results documented in docs/issues/272-add-https-support-with-caddy.md

Notes for Reviewers

This is a draft PR - the implementation is functional but there are still remaining phases to complete. Early feedback on the architecture and approach is welcome.

Key files to review:

• templates/caddy/Caddyfile.tera - Caddy template
• src/application/command_handlers/create/config/https.rs - HTTPS configuration DTOs
• src/application/command_handlers/release/handler.rs - Release workflow integration
• src/infrastructure/templating/caddy/ - Caddy template rendering

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.