Add Caddy reverse proxy configuration and Kopia backup documentation

- Create INFRASTRUCTURE-COMPLETE.md: Comprehensive infrastructure overview
  * Network architecture and DNS configuration
  * Storage architecture for Nextcloud (1.4TB warm storage via LVM)
  * Kopia backup setup with Backblaze B2 integration
  * Caddy reverse proxy configuration (CT 202)
  * Security configuration and capacity planning

- Add Caddy reverse proxy configurations:
  * caddy-kopia-integration.md: Integration steps for CT 202
  * caddy-kopia-reverse-proxy.md: Complete configuration reference
  * caddy/Caddyfile: Production-ready configuration
  * caddy/docker-compose.yml: Docker deployment spec

- Add Kopia backup documentation:
  * kopia-nextcloud-backblaze-setup.md: Complete Kopia setup guide
  * Backup strategy, retention policies, and restore procedures

- Update related documentation with consolidated references

Status: Infrastructure documented and ready for deployment

caddy/docker-compose.yml

@@ -0,0 +1,108 @@
+version: '3.8'
+
+# Caddy Reverse Proxy for Homelab Services
+# Location: /srv/docker/caddy/docker-compose.yml
+# Last Updated: April 27, 2026
+#
+# This service acts as a reverse proxy and HTTPS termination point for internal services
+# Routes requests to appropriate backends and handles TLS encryption
+
+services:
+  caddy:
+    image: caddy:latest
+    container_name: caddy
+    restart: unless-stopped
+
+    # Network ports
+    ports:
+      # Port 80: HTTP (redirects to HTTPS)
+      - "80:80"
+      # Port 443: HTTPS (main service port)
+      - "443:443"
+
+    # Volume mounts
+    volumes:
+      # Configuration file (read-only to prevent accidental modification)
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+
+      # Persistent storage for certificates and configuration
+      # These volumes survive container restarts and updates
+      - caddy_data:/data
+      - caddy_config:/config
+
+      # Log directory (optional, for debugging)
+      - ./logs:/var/log/caddy
+
+    # Environment variables
+    environment:
+      # ACME server for Let's Encrypt (public domain setup)
+      # For internal use, Caddy will generate self-signed certificates
+      CADDY_ACME_CA: "https://acme-v02.api.letsencrypt.org/directory"
+
+      # Email for Let's Encrypt renewal notifications (optional, for public domains)
+      CADDY_ACME_EMAIL: "jgitta@jgitta.com"
+
+    # Network connectivity
+    networks:
+      - docker_network
+
+    # Container labels for identification and monitoring
+    labels:
+      com.example.description: "Caddy reverse proxy for homelab services"
+      com.example.version: "latest"
+
+    # Health check - ensures container is working
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+    # Container logging
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+        labels: "caddy=true"
+
+# Named volumes for persistent data
+volumes:
+  # Certificate storage (TLS certificates, whether self-signed or Let's Encrypt)
+  caddy_data:
+    driver: local
+
+  # Configuration storage (Caddy internal config and metadata)
+  caddy_config:
+    driver: local
+
+# Network definition
+networks:
+  docker_network:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/16
+
+# Usage Instructions:
+#
+# Start the service:
+#   cd /srv/docker/caddy
+#   docker-compose up -d
+#
+# Check status:
+#   docker-compose ps
+#
+# View logs:
+#   docker-compose logs -f caddy
+#
+# Reload configuration (no downtime):
+#   docker-compose restart caddy
+#
+# Stop the service:
+#   docker-compose down
+#
+# Update to latest Caddy version:
+#   docker-compose pull
+#   docker-compose up -d