Add Fly.io public reverse proxy for docs.eblu.me (#120)

## Summary

- Adds a Fly.io reverse proxy (`blumeops-proxy`) that tunnels public traffic to homelab services over Tailscale
- First service exposed: `docs.eblu.me` — the Quartz static docs site
- Includes Pulumi IaC for Tailscale auth key/ACLs and Gandi DNS CNAME
- Adds mise tasks (`fly-deploy`, `fly-setup`, `fly-shutoff`) and Forgejo CI workflow

## Key details

- Fly.io Firecracker VMs support TUN devices natively — no userspace networking needed
- Tailscale auth key is `preauthorized=True` to avoid device approval hangs on container restarts
- nginx caches aggressively for the static site; health check is on the default_server block
- ACLs restrict `tag:flyio-proxy` to `tag:k8s` on port 443 only
- DNS CNAME deployed and verified: `docs.eblu.me` → `blumeops-proxy.fly.dev`

## Test plan

- [x] `curl -sf https://blumeops-proxy.fly.dev/healthz` returns `ok`
- [x] `curl -I -H "Host: docs.eblu.me" https://blumeops-proxy.fly.dev/` returns 200 with `X-Cache-Status`
- [x] `curl -I https://docs.eblu.me/` returns 200 with valid Let's Encrypt cert
- [x] `dig forge.ops.eblu.me` still resolves to 100.98.163.89 (private services unaffected)
- [x] Set `FLY_DEPLOY_TOKEN` Forgejo Actions secret for CI auto-deploy

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/120

docs/reference/services/caddy.md

@@ -47,7 +47,7 @@ K8s services are proxied via their Tailscale Ingress endpoints:
 |-----------|---------|---------|
 | `grafana.ops.eblu.me` | `grafana.tail8d86e.ts.net` | [[grafana]] |
 | `argocd.ops.eblu.me` | `argocd.tail8d86e.ts.net` | [[argocd]] |
-| `docs.ops.eblu.me` | `docs.tail8d86e.ts.net` | [[docs]] |
+| `docs.ops.eblu.me` | `docs.tail8d86e.ts.net` | [[docs]] (now publicly available at `docs.eblu.me` via [[flyio-proxy]]) |
 | `feed.ops.eblu.me` | `feed.tail8d86e.ts.net` | [[miniflux]] |
 | ... | ... | (see defaults/main.yml for full list) |
 

docs/reference/services/docs.md

@@ -13,11 +13,13 @@ Documentation site built with [Quartz](https://quartz.jzhao.xyz/) and served via
 
 | Property | Value |
 |----------|-------|
-| **URL** | https://docs.ops.eblu.me |
+| **Public URL** | https://docs.eblu.me |
+| **Private URL** | `docs.ops.eblu.me` (tailnet only, via [[caddy]]) |
 | **Namespace** | `docs` |
 | **Container** | `registry.ops.eblu.me/blumeops/quartz:v1.0.0` |
 | **Source** | `docs/` directory in blumeops repo |
 | **Build** | Forgejo workflow `build-blumeops.yaml` |
+| **Public proxy** | [[flyio-proxy]] (Fly.io → Tailscale tunnel) |
 
 ## Architecture
 

docs/reference/services/flyio-proxy.md

@@ -0,0 +1,64 @@
+---
+title: Fly.io Proxy
+tags:
+  - service
+  - networking
+  - fly-io
+---
+
+# Fly.io Proxy
+
+Public reverse proxy on [Fly.io](https://fly.io) that exposes selected BlumeOps services to the internet via a Tailscale tunnel back to the homelab.
+
+## Quick Reference
+
+| Property | Value |
+|----------|-------|
+| **App** | `blumeops-proxy` |
+| **Region** | `sjc` (San Jose) |
+| **Fly.io URL** | `blumeops-proxy.fly.dev` |
+| **Config** | `fly/` directory in repo |
+| **IaC** | `fly/fly.toml` (app), Pulumi (DNS + auth key) |
+
+## Exposed Services
+
+| Public domain | Backend | Service |
+|---------------|---------|---------|
+| `docs.eblu.me` | `docs.tail8d86e.ts.net` | [[docs]] |
+
+## Architecture
+
+Internet traffic hits Fly.io's Anycast edge, terminates TLS with a Let's Encrypt certificate, and is proxied by nginx to the backend service over a Tailscale WireGuard tunnel. See [[expose-service-publicly]] for the full architecture diagram.
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `fly/fly.toml` | App configuration |
+| `fly/Dockerfile` | nginx + Tailscale container |
+| `fly/nginx.conf` | Reverse proxy, caching, rate limiting |
+| `fly/start.sh` | Entrypoint: start Tailscale, then nginx |
+| `pulumi/tailscale/__main__.py` | Auth key (`tag:flyio-proxy`) |
+| `pulumi/tailscale/policy.hujson` | ACL grants for proxy |
+| `pulumi/gandi/__main__.py` | DNS CNAMEs |
+
+## Networking
+
+Fly.io runs Firecracker microVMs which support TUN devices natively. Tailscale runs with a real TUN interface (not userspace networking), so MagicDNS and direct Tailscale IP routing work normally.
+
+The Tailscale auth key is `preauthorized=True` to avoid device approval hangs on container restarts.
+
+## Secrets
+
+| Secret | Source | Description |
+|--------|--------|-------------|
+| `TS_AUTHKEY` | Pulumi state → `fly secrets` | Tailscale auth key for joining tailnet |
+| `FLY_DEPLOY_TOKEN` | Fly.io → 1Password | Deploy token for CI |
+
+## Related
+
+- [[expose-service-publicly]] - Setup guide for adding new public services
+- [[manage-flyio-proxy]] - Operational tasks (deploy, shutoff, troubleshoot)
+- [[caddy]] - Private reverse proxy for `*.ops.eblu.me` (separate system)
+- [[tailscale]] - WireGuard mesh network
+- [[gandi]] - DNS hosting