feat(gateway): deploy Cloudflare DDNS daemon, wildcard SSL cert, and Caddy HTTPS reverse proxy on 10443

stacks/gateway/Caddyfile

@@ -0,0 +1,28 @@
+# ==============================================================================
+# 家庭公网 HTTPS 统一反向代理网关 (Mac mini: 10443 端口)
+# 证书：/certs/fullchain.pem & /certs/privkey.pem (由 acme.sh 自动续签 *.home.961504.xyz)
+# ==============================================================================
+{
+    auto_https disable_redirects
+}
+
+# 1. 极空间 Z4 NAS (https://z4.home.961504.xyz:10443 或 https://nas.home.961504.xyz:10443)
+nas.home.961504.xyz:10443, z4.home.961504.xyz:10443 {
+    tls /certs/fullchain.pem /certs/privkey.pem
+    encode zstd gzip
+    reverse_proxy 192.168.31.185:5055
+}
+
+# 2. Lucky 控制台 (https://lucky.home.961504.xyz:10443)
+lucky.home.961504.xyz:10443 {
+    tls /certs/fullchain.pem /certs/privkey.pem
+    encode zstd gzip
+    reverse_proxy host.docker.internal:16601
+}
+
+# 3. 路由器 Mihomo / Clash 面板 (https://clash.home.961504.xyz:10443)
+clash.home.961504.xyz:10443 {
+    tls /certs/fullchain.pem /certs/privkey.pem
+    encode zstd gzip
+    reverse_proxy 192.168.31.1:9999
+}

stacks/gateway/docker-compose.yml

@@ -0,0 +1,17 @@
+services:
+  caddy:
+    image: caddy:2-alpine
+    container_name: home-gateway
+    restart: always
+    ports:
+      - "10443:10443/tcp"
+      - "10443:10443/udp"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./certs:/certs:ro
+      - ./caddy_data:/data
+      - ./caddy_config:/config
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - TZ=Asia/Shanghai

stacks/lucky/docker-compose.yml

@@ -3,11 +3,9 @@ services:
     image: gdy666/lucky:latest
     container_name: lucky
     restart: always
-    # 在 macOS (OrbStack) 下，使用端口映射暴露管理端口与统一反代端口
+    # 在 macOS (OrbStack) 下暴露管理端口 (10443 统一反代由 stacks/gateway 中的 Caddy 承担以实现明文 Git 版本管理)
     ports:
-      - "16601:16601/tcp"   # Lucky Web 管理后台端口 (仅内网或配置安全入口后访问)
+      - "16601:16601/tcp"   # Lucky Web 管理后台端口
-      - "10443:10443/tcp"   # 家宽公网统一 HTTPS 反向代理入口端口 (TCP)
-      - "10443:10443/udp"   # HTTP/3 QUIC 支持 (UDP)
     volumes:
       - ./goodluck:/goodluck
       - /etc/localtime:/etc/localtime:ro