Run app on host port 5000 behind reverse proxy

Caddy still listens on :80 inside the container, but only port 5000 is
exposed to the host. Removes 443/HTTPS ports and Caddy cert volumes —
TLS is handled by the upstream reverse proxy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -19,8 +19,6 @@ jobs:
           APP_KEY=${{ secrets.APP_KEY }}
           APP_DEBUG=false
           APP_URL=${{ vars.APP_URL }}
-          SERVER_NAME=${{ vars.APP_DOMAIN }}
-          CADDY_EMAIL=${{ vars.CADDY_EMAIL }}
           DB_CONNECTION=mariadb
           DB_HOST=db
           DB_PORT=3306

docker-compose.yml

@@ -3,12 +3,9 @@ services:
     build: .
     restart: unless-stopped
     ports:
-      - "80:80"
+      - "5000:80"
-      - "443:443"
-      - "443:443/udp"   # HTTP/3
     environment:
-      SERVER_NAME: "${APP_DOMAIN:-:80}"
+      SERVER_NAME: ":80"
-      CADDY_EMAIL: "${CADDY_EMAIL:-}"
       APP_ENV: "${APP_ENV:-production}"
       APP_KEY: "${APP_KEY}"
       APP_URL: "${APP_URL}"
@@ -24,8 +21,6 @@ services:
       QUEUE_CONNECTION: sync
       LOG_CHANNEL: stderr
     volumes:
-      - caddy_data:/data
-      - caddy_config:/config
       - storage_uploads:/app/storage/app
       - storage_logs:/app/storage/logs
     depends_on:
@@ -49,8 +44,6 @@ services:
       retries: 10
 
 volumes:
-  caddy_data:
-  caddy_config:
   db_data:
   storage_uploads:
   storage_logs: