deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy

- site nginx listens on 1337; proxies /api/contact to the relay over the internal
  network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
  (non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -1,8 +1,6 @@
-# Production stack (DOCKER_SPEC §2). Publishes no host ports — Traefik (the host's
-# existing reverse proxy) discovers these containers on the shared traefik_proxy
-# network via the labels below and routes cesnimda.co.uk to the site, and
-# cesnimda.co.uk/api/contact to the relay. Entrypoint / cert-resolver names match
-# the host Traefik convention; override via the .env values if they differ.
+# Production stack. The public-facing site is published on host port 1337 (put your
+# TLS terminator / Cloudflare in front of it). nginx inside the site container proxies
+# /api/contact to the relay over the internal network, so only one port is exposed.
 
 services:
   site:
@@ -16,14 +14,11 @@ services:
       - /tmp
       - /var/cache/nginx
       - /var/run
-    networks: [proxy]
-    labels:
-      - traefik.enable=true
-      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
-      - traefik.http.routers.resumesite.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`)
-      - traefik.http.routers.resumesite.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
-      - traefik.http.routers.resumesite.tls=true
-      - traefik.http.services.resumesite.loadbalancer.server.port=8080
+    ports:
+      - '${SITE_PORT:-1337}:1337'
+    depends_on:
+      - relay
+    networks: [web]
     logging:
       driver: json-file
       options: { max-size: '10m', max-file: '3' }
@@ -36,29 +31,20 @@ services:
     restart: unless-stopped
     read_only: true
     environment:
-      - Smtp__Host=${SMTP_HOST}
+      - Smtp__Host=${SMTP_HOST:-}
       - Smtp__Port=${SMTP_PORT:-587}
-      - Smtp__User=${SMTP_USER}
-      - Smtp__Password=${SMTP_PASSWORD}
+      - Smtp__User=${SMTP_USER:-}
+      - Smtp__Password=${SMTP_PASSWORD:-}
       - Relay__FromAddress=${RELAY_FROM:-}
-      - Relay__ToAddress=${RELAY_TO}
+      - Relay__ToAddress=${RELAY_TO:-connor.babbington@cesnimda.co.uk}
       - Relay__AllowedOrigin=${RELAY_ALLOWED_ORIGIN:-https://cesnimda.co.uk}
       - Relay__RateLimitPerWindow=${RELAY_RATE_LIMIT:-5}
       - Relay__WindowSeconds=${RELAY_WINDOW_SECONDS:-600}
-    networks: [proxy]
-    labels:
-      - traefik.enable=true
-      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
-      # More specific rule than the site router, so /api/contact wins.
-      - traefik.http.routers.resumerelay.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`) && PathPrefix(`/api/contact`)
-      - traefik.http.routers.resumerelay.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
-      - traefik.http.routers.resumerelay.tls=true
-      - traefik.http.services.resumerelay.loadbalancer.server.port=8081
+    networks: [web]
     logging:
       driver: json-file
       options: { max-size: '10m', max-file: '3' }
 
 networks:
-  proxy:
-    external: true
-    name: ${PROXY_NETWORK:-traefik_proxy}
+  web:
+    driver: bridge