docs: deployment templates for Cloudflare Tunnel, Caddy, Fly.io, Render

examples/compose/cloudflared-paired.yml pairs RefBoard with a cloudflared
sidecar reading a TUNNEL_TOKEN env var — no inbound ports needed, suitable
for home / studio servers.

examples/compose/behind-caddy.yml + Caddyfile fronts RefBoard with Caddy
for automatic Let's Encrypt TLS on a public hostname. Caddy 2's
reverse_proxy transparently upgrades Socket.IO WebSockets.

examples/fly.toml deploys to Fly.io using the GHCR image and a persistent
volume mounted at /app/data. STORAGE_BACKEND=fs so the whole stack is one
machine with one disk.

examples/render.yaml is a Render.com Blueprint targeting the same shape
(GHCR image + attached disk + FS storage).

examples/README.md indexes everything and adds notes for Coolify /
Dokploy / CapRover / Railway, which consume the existing compose file
directly without a dedicated template.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

examples/compose/behind-caddy.yml

@@ -0,0 +1,55 @@
+# RefBoard + Caddy reverse proxy with automatic TLS.
+#
+# Use this on a publicly-reachable host (cloud VPS, dedicated box on a public
+# IP, port 443 open). Caddy provisions and renews a Let's Encrypt cert for
+# the hostname you set in REFBOARD_DOMAIN, and transparently upgrades the
+# Socket.IO WebSocket connection.
+#
+# Setup:
+#   1. Point an A / AAAA record for your hostname at this server's public IP.
+#   2. In .env set:
+#        REFBOARD_DOMAIN=refboard.example.com
+#        CORS_ORIGIN=https://refboard.example.com
+#        JWT_SECRET=$(openssl rand -base64 64)
+#        ALLOW_SELF_REGISTRATION=false
+#   3. docker compose -f examples/compose/behind-caddy.yml up -d
+
+services:
+  refboard:
+    image: ${REFBOARD_IMAGE:-ghcr.io/metalfinger/refboard:latest}
+    container_name: refboard
+    environment:
+      PORT: 8000
+      NODE_ENV: production
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env for public deploys}
+      STORAGE_BACKEND: fs
+      STORAGE_DATA_DIR: /app/data/storage
+      DB_PATH: /app/data/refboard.db
+      CORS_ORIGIN: ${CORS_ORIGIN:?set CORS_ORIGIN to your public URL}
+      MAX_FILE_SIZE_MB: ${MAX_FILE_SIZE_MB:-200}
+      SEED_ADMIN_EMAIL: ${SEED_ADMIN_EMAIL:-}
+      SEED_ADMIN_PASSWORD: ${SEED_ADMIN_PASSWORD:-}
+      ALLOW_SELF_REGISTRATION: ${ALLOW_SELF_REGISTRATION:-false}
+    volumes:
+      - ./.docker-data/refboard:/app/data
+    restart: unless-stopped
+
+  caddy:
+    image: caddy:2-alpine
+    container_name: refboard-caddy
+    depends_on:
+      - refboard
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      REFBOARD_DOMAIN: ${REFBOARD_DOMAIN:?set REFBOARD_DOMAIN in .env}
+    volumes:
+      - ./examples/compose/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    restart: unless-stopped
+
+volumes:
+  caddy_data:
+  caddy_config: