Deploy behind an existing reverse proxy

docker-compose.behind-proxy.yml skips Caddy and publishes only the web app
and API on localhost, for a proxy like NPMplus that already owns 80/443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

deploy/production.env.example

@@ -26,3 +26,10 @@ SMTP_PORT=465
 SMTP_USER=
 SMTP_PASSWORD=
 MAIL_FROM=musicshare <app@musicshare.binarygnome.com>
+
+# Only with docker-compose.behind-proxy.yml (an existing proxy like NPMplus owns 80/443):
+# the ports the proxy forwards to. Use 127.0.0.1 if the proxy runs with host networking,
+# otherwise this server's LAN IP.
+PROXY_BIND=127.0.0.1
+WEB_PORT=3737
+API_PORT=3738

docker-compose.behind-proxy.yml

@@ -0,0 +1,22 @@
+# Production behind an existing reverse proxy (e.g. NPMplus / Nginx Proxy Manager)
+# that owns ports 80/443 and handles HTTPS. No Caddy: the web app and API are
+# published on the host for the proxy to reach.
+#
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.behind-proxy.yml \
+#     --env-file deploy/production.env up -d --build
+#
+# In the proxy, for your domain:
+#   /        -> http://127.0.0.1:3737   (WEB_PORT)
+#   /api/    -> http://127.0.0.1:3738/  (API_PORT; strip the /api prefix, websockets on)
+
+services:
+  caddy:
+    profiles: ["caddy"] # not started
+
+  web:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${WEB_PORT:-3737}:3737"
+
+  api:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${API_PORT:-3738}:4000"