Version-control the shared Caddy edge proxy

The droplet's single Caddy container terminates TLS for every site and routes
each host to its upstream over proxy_net. Until now its only copy lived on the
server; capture compose.yaml and the Caddyfile here, with a README covering how
to add a site and reload without downtime. ACME material is git-ignored.

compose.yaml

@@ -0,0 +1,23 @@
+name: central-proxy
+
+services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - proxy_net
+
+networks:
+  proxy_net:
+    external: true
+
+volumes:
+  caddy_data:
+  caddy_config: