Add Caddy reverse proxy configuration and Kopia backup documentation

- Create INFRASTRUCTURE-COMPLETE.md: Comprehensive infrastructure overview
  * Network architecture and DNS configuration
  * Storage architecture for Nextcloud (1.4TB warm storage via LVM)
  * Kopia backup setup with Backblaze B2 integration
  * Caddy reverse proxy configuration (CT 202)
  * Security configuration and capacity planning

- Add Caddy reverse proxy configurations:
  * caddy-kopia-integration.md: Integration steps for CT 202
  * caddy-kopia-reverse-proxy.md: Complete configuration reference
  * caddy/Caddyfile: Production-ready configuration
  * caddy/docker-compose.yml: Docker deployment spec

- Add Kopia backup documentation:
  * kopia-nextcloud-backblaze-setup.md: Complete Kopia setup guide
  * Backup strategy, retention policies, and restore procedures

- Update related documentation with consolidated references

Status: Infrastructure documented and ready for deployment

caddy/Caddyfile

@@ -0,0 +1,65 @@
+# Caddy Configuration for Homelab
+# Location: /srv/docker/caddy/Caddyfile
+# Last Updated: April 27, 2026
+
+# ============================================================================
+# Kopia Web UI - HTTPS Reverse Proxy
+# ============================================================================
+kopia.jgitta.com {
+    # Reverse proxy to Kopia Web UI running on localhost:51515
+    reverse_proxy 127.0.0.1:51515 {
+        # Pass original headers for proper proxying
+        header_upstream X-Forwarded-Proto {scheme}
+        header_upstream X-Forwarded-Host {http.request.host}
+        header_upstream X-Forwarded-For {http.request.remote.host}
+
+        # WebSocket support (Kopia uses WebSockets for real-time updates)
+        header_upstream Connection {http.request.header.Connection}
+        header_upstream Upgrade {http.request.header.Upgrade}
+
+        # Timeout settings for backup operations (which can be slow)
+        timeout 300s
+    }
+
+    # Security headers
+    header {
+        # Prevent MIME type sniffing
+        X-Content-Type-Options "nosniff"
+
+        # Clickjacking protection
+        X-Frame-Options "SAMEORIGIN"
+
+        # XSS protection
+        X-XSS-Protection "1; mode=block"
+
+        # HTTPS enforcement (HSTS)
+        # max-age: 1 year, includeSubDomains: apply to subdomains
+        Strict-Transport-Security "max-age=31536000; includeSubDomains"
+
+        # Content Security Policy (basic)
+        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+
+        # Referrer policy
+        Referrer-Policy "strict-origin-when-cross-origin"
+
+        # Permissions policy
+        Permissions-Policy "geolocation=(), microphone=(), camera=()"
+    }
+
+    # Logging
+    log {
+        output stdout
+        format json
+    }
+
+    # Enable TLS (automatic, self-signed for internal use)
+    tls internal
+}
+
+# ============================================================================
+# HTTP to HTTPS Redirect
+# ============================================================================
+http://kopia.jgitta.com {
+    # Redirect all HTTP traffic to HTTPS
+    redir https://kopia.jgitta.com{uri} permanent
+}