Project preview instances (gig-platform, gig-app) publish no host ports; they
join an external `edge` Docker network under instance-qualified aliases.
- Caddy joins `edge` and loads per-project sites from sites/*.caddy. It is the
LAN entry: split DNS → Caddy → instance, by hostname label.
- New preview tunnel, `cloudflared-preview`, on `edge` only. It routes public
instance hostnames straight to their aliases, so public previews do not
depend on Caddy, and the connector cannot reach Caddy, the host or LAN
services. The infra tunnel keeps fronting the host's own services via Caddy
and has no route to instances.
- sites/gig-platform.caddy and sites/gig-app.caddy mirror gig-platform's
docs/deploy/caddy/.
- The old host-port gig blocks move to sites/legacy-gig.caddy, to delete at
gig-platform's main cutover.
- Global client-IP trust for requests arriving through cloudflared.
Validated with the custom Cloudflare-DNS build (`caddy validate`).
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MTExEkPpPMV4gSdfHpztra
kongkxandClaude Opus 5