drop caddy and cloudflared; publish via tailscale funnel; rewrite README

docker-compose.yml

@@ -19,10 +19,12 @@ services:
 
   app:
     build: .
-    # --- Публикация портов через reverse-proxy (Caddy), см. сервис caddy ниже ---
+    expose:
+      - "3000"
+      - "3443"
     ports:
-      - "3000:3000"
-      - "3443:3443"
+      - "127.0.0.1:3000:3000"
+      - "127.0.0.1:3443:3443"
     environment:
       DATABASE_URL: postgres://app:${DB_PASSWORD}@db:5432/whereldo
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
@@ -33,36 +35,32 @@ services:
     volumes:
       - ./uploads:/app/uploads
 
-  # --- Настоящий TLS (Let's Encrypt) перед публичным запуском ---
-  #
-  # Расскомментируйте сервис caddy, скопируйте Caddyfile.example в Caddyfile,
-  # замените yourdomain.example на реальный домен и в app замените блок ports:
-  #
-  #   expose:
-  #     - "3000"
-  #     - "3443"
-  #   ports:
-  #     - "127.0.0.1:3000:3000"
-  #     - "127.0.0.1:3443:3443"     (и удалить внешние "3000:3000" / "3443:3443")
-  #
-  # Затем: docker compose up -d --build
-  #
-  # caddy:
-  #   image: caddy:2-alpine
-  #   restart: unless-stopped
-  #   ports:
-  #     - "80:80"
-  #     - "443:443"
-  #   environment:
-  #     DOMAIN: yourdomain.example          # ЗАМЕНИТЕ на реальный домен
-  #   volumes:
-  #     - ./Caddyfile:/etc/caddy/Caddyfile:ro
-  #     - caddy_data:/data
-  #     - caddy_config:/config
-  #   depends_on:
-  #     - app
+  # Публикация через Tailscale (Serve / Funnel) без проброса портов.
+  # Приложение доступно по https://whatido.<tailnet>.ts.net
+  tailscale:
+    image: tailscale/tailscale:latest
+    hostname: whatido
+    restart: unless-stopped
+    network_mode: host
+    entrypoint: ["/bin/sh", "-c"]
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      SSL_CERT_FILE: /etc/tailscale/app-certs/cert.pem
+    volumes:
+      - /var/lib/tailscale:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+      - /lib/modules:/lib/modules:ro
+      - ./certs:/etc/tailscale/app-certs:ro
+    command: >
+      "tailscaled &
+       sleep 6 &&
+       tailscale up --hostname=whatido --accept-dns=false &&
+       tailscale funnel --bg --yes https://127.0.0.1:3443 &&
+       sleep infinity"
+    depends_on:
+      - app
 
 volumes:
-  pgdata:
-  # caddy_data:
-  # caddy_config:
+  pgdata: