Backend Phase C: Sync-Kern + Caddy behind-proxy

Sync-Kern:
- internal/sync/hlc.go: Hybrid Logical Clock (wall_ms<<16|counter)
  Tick/Now/After, global mutex, strikt monoton + kausal korrekt
- internal/sync/hlc_test.go: Unit-Tests (monoton, kausal, keine Duplikate)

Store-Schicht:
- internal/store/opstore.go: AppendOps idempotent via UNIQUE(client_id,
  client_seq) ON CONFLICT DO NOTHING; LWW-Projektion (list_create/
  rename/delete, item_add/update/remove) in derselben Transaktion;
  PullOps mit Cursor (seq > since, 500er Pages)
- internal/store/liststore.go: CreateList / GetLists / GetList
- internal/store/itemstore.go: GetItems (nicht-gelöschte Items)
- internal/store/suggeststore.go: Search (pg_trgm + LIKE-fallback, 10)

HTTP-Handler:
- internal/httpapi/lists.go: GET/POST /api/lists, GET /api/lists/{id}
- internal/httpapi/ops.go: POST /api/lists/{id}/ops (Push),
  GET /api/lists/{id}/ops (Pull ?since=)
- internal/httpapi/suggest.go: GET /api/suggestions?q=
- internal/httpapi/api.go: alle Routen verdrahtet (RequireAuth)

Deployment:
- deploy/Caddyfile.behind-proxy: auto_https off, trusted_proxies
- deploy/Caddyfile: X-Forwarded-Proto hinzugefügt, Kommentar aktualisiert
- deploy/docker-compose.yml: CADDY_HTTP_PORT + CADDY_HTTPS_PORT
- deploy/.env.example: Caddy-Port-Variablen dokumentiert

go build ./... && go vet ./... && go test ./... ✅
HLC-Tests: monoton, kausal, keine Duplikate ✅
AGENTS.md: Phase C vollständig ✅

deploy/.env.example

@@ -42,3 +42,15 @@ OIDC_GENERIC_CLIENT_ID=             # audience the backend accepts
 # --- CORS (only relevant for browser clients; Android doesn't need it) ---
 # Comma-separated list of allowed origins, e.g. https://app.example.com
 CORS_ALLOWED_ORIGINS=
+
+# --- Caddy ports ---
+# Standalone mode (Caddy handles TLS directly):
+CADDY_HTTP_PORT=80
+CADDY_HTTPS_PORT=443
+
+# Behind a reverse proxy (your proxy does TLS, Caddy is plain HTTP):
+# 1. Change CADDY_HTTP_PORT to the port your proxy forwards to.
+# 2. Mount Caddyfile.behind-proxy instead of Caddyfile in docker-compose.yml.
+# 3. Remove the CADDY_HTTPS_PORT lines from docker-compose caddy.ports.
+#
+# CADDY_HTTP_PORT=8880

deploy/Caddyfile

@@ -1,25 +1,27 @@
-# Caddyfile for mitbringsl.
+# Caddyfile for mitbringsl – standalone mode (default).
 # Caddy automatically obtains and renews a Let's Encrypt certificate when the
 # site address is a real domain. For local development it falls back to an
 # internal CA / self-signed cert automatically.
+#
+# To run behind your own reverse proxy instead, mount Caddyfile.behind-proxy.
 {
-	# email you@example.com   # optional, for ACME account
+	# email you@example.com   # optional, for ACME account registration
 }
 
 {$SITE_ADDRESS:localhost} {
 	reverse_proxy backend:8080 {
-		header_up X-Real-IP {remote_host}
-		header_up X-Forwarded-For {remote_host}
+		header_up X-Real-IP        {remote_host}
+		header_up X-Forwarded-For  {remote_host}
+		header_up X-Forwarded-Proto {scheme}
 	}
 
-	# Useful default headers
+	# Useful default security headers
 	header {
 		Strict-Transport-Security "max-age=31536000"
 		X-Content-Type-Options "nosniff"
 		Referrer-Policy "no-referrer"
 	}
 
-	# Health endpoint passthrough already handled by backend; keep it simple.
 	request_body {
 		max_size 2MB
 	}

deploy/Caddyfile.behind-proxy

@@ -0,0 +1,41 @@
+# Caddyfile for mitbringsl – behind external reverse proxy mode.
+#
+# Use this when your own reverse proxy (nginx, Traefik, etc.) handles TLS
+# termination and routes traffic to Caddy over plain HTTP on the internal
+# Docker network.
+#
+# In docker-compose.yml, mount this file instead of the default Caddyfile:
+#   volumes:
+#     - ./Caddyfile.behind-proxy:/etc/caddy/Caddyfile:ro
+#
+# Your external proxy should set:
+#   X-Forwarded-For   <client-ip>
+#   X-Forwarded-Proto https
+#   Host              <your-domain>
+{
+	# Disable auto-HTTPS – TLS is handled by the outer proxy.
+	auto_https off
+}
+
+:80 {
+	# Trust the private-network upstream so X-Forwarded-* headers are accepted.
+	# Change to a specific IP/CIDR if your proxy has a fixed address.
+	trusted_proxies private_ranges
+
+	reverse_proxy backend:8080 {
+		# Forward the real client IP to the backend.
+		header_up X-Real-IP        {http.request.header.X-Forwarded-For}
+		header_up X-Forwarded-For  {http.request.header.X-Forwarded-For}
+		header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
+	}
+
+	# Enforce a sensible request body size limit.
+	request_body {
+		max_size 2MB
+	}
+
+	log {
+		output stdout
+		format console
+	}
+}

deploy/docker-compose.yml

@@ -4,7 +4,7 @@
 #   docker compose up -d --build
 #
 # Services:
-#   caddy    public reverse proxy with automatic HTTPS (Let's Encrypt)
+#   caddy    reverse proxy (auto-HTTPS by default; see "Behind a Reverse Proxy" below)
 #   backend  mitbringsl Go API (image builds server + migrate binaries)
 #   migrate  one-shot migration runner, must finish before backend starts
 #   db       PostgreSQL 16
@@ -81,10 +81,22 @@ services:
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
+    # --- Standalone mode (default): Caddy handles TLS via Let's Encrypt ----
+    # Exposes ports 80 (ACME HTTP-01 challenge) and 443 (HTTPS + HTTP/3).
     ports:
-      - "80:80"        # ACME HTTP-01 challenge + redirect
-      - "443:443"
-      - "443:443/udp"  # HTTP/3
+      - "${CADDY_HTTP_PORT:-80}:80"
+      - "${CADDY_HTTPS_PORT:-443}:443"
+      - "${CADDY_HTTPS_PORT:-443}:443/udp"   # HTTP/3
+    # --- Behind a Reverse Proxy mode ----------------------------------------
+    # If your own proxy handles TLS, set CADDY_HTTP_PORT to the port your proxy
+    # forwards to (e.g. 8880), and mount Caddyfile.behind-proxy instead:
+    #
+    #   CADDY_HTTP_PORT=8880
+    #   volumes:
+    #     - ./Caddyfile.behind-proxy:/etc/caddy/Caddyfile:ro
+    #
+    # Also remove the CADDY_HTTPS_PORT ports above and comment out this note.
+    # -------------------------------------------------------------------------
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy_data:/data