Make ports 80 and 443 compatible with UFW

deployment/caddy/Caddyfile

@@ -1,3 +1,18 @@
+{
+	servers {
+		listener_wrappers {
+			proxy_protocol
+			tls
+		}
+
+		# Only trust PROXY protocol from local forwarder.
+		trusted_proxies static 127.0.0.1/32 ::1/128
+	}
+
+	http_port 8080
+	https_port 8443
+}
+
 fromchat.ru {
 	reverse_proxy frontend:8301 {
 		header_up X-Real-IP {remote_host}
@@ -102,12 +117,4 @@ git.fromchat.ru {
 			events 500
 		}
 	}
-}
-
-api.getgadgets.toolbox-io.ru {
-    reverse_proxy 95.165.0.162:8400
-}
-
-getgadgets.toolbox-io.ru {
-    reverse_proxy 95.165.0.162:8401
 }

deployment/docker-compose.yml

@@ -167,8 +167,8 @@ services:
       - production
     restart: unless-stopped
     ports:
-      - "80:80"
-      - "443:443"
+      - "127.0.0.1:8080:8080"
+      - "127.0.0.1:8443:8443"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
@@ -179,6 +179,22 @@ services:
     networks:
       - public
 
+  haproxy:
+    image: haproxy:latest
+    profiles:
+      - production
+    restart: unless-stopped
+    network_mode: host
+    # Image defaults to USER haproxy (non-root); that user cannot bind 80/443 on host.
+    # Rootful Docker does not change that — only the container user does.
+    user: "0:0"
+    cap_add:
+      - NET_BIND_SERVICE
+    depends_on:
+      - caddy
+    volumes:
+      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+
   postgres:
     build:
       context: .

deployment/haproxy.cfg

@@ -0,0 +1,26 @@
+global
+  maxconn 4096
+  # Start as root to bind 80/443, then drop privileges.
+  user haproxy
+  group haproxy
+
+defaults
+  no log
+  mode tcp
+  timeout connect 5s
+  timeout client  2m
+  timeout server  2m
+
+frontend fe_http_80
+  bind 0.0.0.0:80
+  default_backend be_caddy_http
+
+backend be_caddy_http
+  server caddy_http 127.0.0.1:8080 send-proxy-v2
+
+frontend fe_https_443
+  bind 0.0.0.0:443
+  default_backend be_caddy_https
+
+backend be_caddy_https
+  server caddy_https 127.0.0.1:8443 send-proxy-v2