Add shared public edge (nginx + certbot)

One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.

edge/compose.yml

@@ -0,0 +1,51 @@
+# Shared public edge: the only thing that publishes host ports 80/443. One
+# nginx terminates TLS for every project's domains (Gitea, Musify, ...) and
+# proxies to their containers by name, over the networks below. Certificates
+# come from Let's Encrypt (webroot), renewed by the certbot service.
+#
+#   docker compose -f edge/compose.yml up -d
+#
+# Requires `infra-net` (created by ../compose.yml) and `gitea_gitea` (created
+# by the Gitea stack) to already exist.
+
+name: edge
+
+networks:
+  infra-net:
+    name: infra-net
+    external: true
+  gitea:
+    name: gitea_gitea
+    external: true
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: edge-nginx
+    # The subshell reloads nginx every 6h so renewed certificates get picked up.
+    command:
+      - /bin/sh
+      - -c
+      - "(while :; do sleep 6h; nginx -s reload; done) & exec nginx -g 'daemon off;'"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - ./snippets:/etc/nginx/snippets:ro
+      - ./certbot/www:/var/www/certbot:ro
+      - ./certbot/conf:/etc/letsencrypt:ro
+    networks: [gitea, infra-net]
+    restart: unless-stopped
+
+  certbot:
+    image: certbot/certbot
+    container_name: edge-certbot
+    entrypoint:
+      - /bin/sh
+      - -c
+      - "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done"
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    restart: unless-stopped