chore(deploy): IPv6 on Caddy's network, so IPv6 visitors keep their addresses

Caddy's network had IPv4 alone, so Docker's userland proxy forwarded
every IPv6 visitor to Caddy from the network's gateway, and the server
counted all of them as one network (the second reading's M5, reasoned).
The edge network gets a unique local /64 (fd4a:6c6b:7e80::/64), Caddy a
fixed address in it beside its IPv4 one, both trusted as the proxy; the
CI runner's unit denies fd00::/8 and its sandbox check tries Caddy's IPv6
address too. A commit of its own: it needs Docker 27 or later with
ip6tables on the server and the network made anew (compose down, never
-v, then up), checked by hand first (NEXT.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.yaml

@@ -47,8 +47,10 @@ services:
       edge:
         # Fixed, so containers behind Caddy can trust it as their proxy (the
         # visitor's own address comes in X-Forwarded-For): the server's
-        # TRUSTED_PROXIES, Jellyfin's known proxies.
+        # TRUSTED_PROXIES, Jellyfin's known proxies. Both, as Caddy may reach
+        # the server by either.
         ipv4_address: 172.30.80.2
+        ipv6_address: fd4a:6c6b:7e80::2
     depends_on:
       - server
     logging: *logging
@@ -84,7 +86,7 @@ services:
       # Caddy, whose X-Forwarded-For names the visitor the per-network limits count
       # (new anonymous accounts, codes by mail, password sign-ins): without it, every
       # visitor would share each limit with everyone. Its address on `edge`, below.
-      TRUSTED_PROXIES: 172.30.80.2
+      TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
       # The day GitHub stops signing anyone in (`2027-01-22`); empty: no end.
       GITHUB_SIGN_IN_ENDS: ${GITHUB_SIGN_IN_ENDS:-}
       # Where the source of what this instance runs is; empty: the project's.
@@ -174,6 +176,15 @@ services:
 networks:
   edge:
     name: halkyon-learn-edge
+    # IPv6 too (the second reading's M5), so Docker forwards a visitor's IPv6
+    # connection to Caddy as it is, rather than through its userland proxy,
+    # which would show every IPv6 visitor as the network's gateway and so make
+    # them share every per-network limit. Needs Docker 27 or later with ip6tables
+    # (its default; not switched off in /etc/docker/daemon.json), and the network
+    # made anew: `docker compose down` (never -v) and `up -d` once, as Compose
+    # refuses a network whose settings changed. A unique local /64 (RFC 4193), the
+    # host's own; the CI runner's unit denies fd00::/8.
+    enable_ipv6: true
     ipam:
       config:
         - subnet: 172.30.80.0/24
@@ -183,6 +194,10 @@ networks:
           # never taken: the server started first once and took Caddy's (2026-10-14).
           # (With a range alone, Docker would move the gateway to its first address.)
           ip_range: 172.30.80.128/25
+        - subnet: fd4a:6c6b:7e80::/64
+          gateway: fd4a:6c6b:7e80::1
+          # As above: Caddy's ::2 and the sidecars' below it stay free.
+          ip_range: fd4a:6c6b:7e80::8000:0/97
 
 volumes:
   caddy_data:

deploy/runner/forgejo-runner.service

@@ -43,7 +43,7 @@ ReadWritePaths=/var/lib/forgejo-runner
 PrivateTmp=yes
 ProtectProc=invisible
 InaccessiblePaths=-/run/docker.sock -/run/containerd -/var/lib/docker
-IPAddressDeny=172.16.0.0/12 192.168.0.0/16
+IPAddressDeny=172.16.0.0/12 192.168.0.0/16 fd00::/8
 NoNewPrivileges=yes
 CapabilityBoundingSet=
 AmbientCapabilities=

deploy/sidecars/README.md

@@ -76,8 +76,8 @@ Steps, in order; ✱ marks a step as root.
    - The wizard: an admin of a name nobody guesses, its password in a password
      manager; a library of the type Movies (or Shows, Music) on `/media/…`; remote
      connections allowed.
-   - Dashboard › Networking › **Known proxies**: `172.30.80.2` (Caddy's address on
-     `edge`). Jellyfin then sees each visitor's own address, and the tunnel as local.
+   - Dashboard › Networking › **Known proxies**: `172.30.80.2` and `fd4a:6c6b:7e80::2`
+     (Caddy's addresses on `edge`). Jellyfin then sees each visitor's own address, and the tunnel as local.
    - Dashboard › General: **Quick Connect** off, unless people sign in with it.
    - Dashboard › Users › the admin: **Hide this user from login screens**; **Allow
      remote connections to this server** off.