[Mammad3861]

Summary

Adds optional trusted HTTPS for Chromium and Firefox using a custom domain and the official Caddy image.

The existing IP-based installation remains unchanged when no domain is provided.

Changes

• Add optional ILB_DOMAIN and ILB_ACME_EMAIL configuration.
• Prompt interactive users for an optional domain.
• Run a shared, project-managed Caddy reverse proxy.
• Bind browser ports to loopback in domain mode.
• Publish ports 80 and 443 through Caddy.
• Preserve Caddy certificates and browser profiles.
• Validate domains and ACME email values before use.
• Add atomic Caddy configuration updates and rollback handling.
• Add safe uninstall and managed-resource cleanup behavior.
• Document domain TLS and browser relaunch behavior.
• Add focused coverage for validation, Docker arguments, permissions, rollback, cleanup, and Caddy startup failures.

Compatibility

Without ILB_DOMAIN, the existing behavior remains unchanged:

• Chromium: ports 3000 and 3001
• Firefox: ports 4000 and 4001
• Existing images, credentials, Chromium flags, and Docker arguments

Verification

• git diff --check: passed
• Bash syntax check: passed
• Local Bash test suite: passed
• GitHub Actions Shell tests: passed

Remaining runtime validation

Before merging, test on a real VPS with:

• DNS pointing to the server
• Inbound ports 80 and 443 available
• Successful ACME certificate issuance
• Caddy reload and certificate persistence
• Browser uninstall and route cleanup
• Existing no-domain/IP installation

[Mammad3861]

Ubuntu 26.04 VPS validation

Real-world testing completed successfully on Ubuntu 26.04.1 LTS (x86_64).

Custom-domain mode

• Chromium and Caddy remained operational for more than 32 hours.
• A valid Let's Encrypt certificate was issued for ra.hibehify.ir.
• Caddy configuration validation passed.
• Caddy exposed only ports 80 and 443.
• Chromium ports 3000 and 3001 were bound to loopback.
• Persistent Caddy data and config directories had mode 700.
• Uninstall removed the browser route, managed Caddy container, and managed Docker network.
• Persistent certificate data was preserved.

No-domain compatibility

• Chromium installed successfully with ILB_DOMAIN=.
• Existing ports 3000 and 3001 remained publicly mapped.
• HTTPS returned the expected 401 Unauthorized authentication challenge.
• No Caddy container was created.
• Uninstall completed successfully and left no containers behind.

Mobile Selkies usability remains dependent on viewport and client behavior, but installation, authentication, browsing, persistence, TLS, rollback, and cleanup were functional.