Add optional public edge proxy network

[bseverns]

Summary

• add an opt-in Compose overlay that attaches only the Memory Engine Caddy proxy to the external public_edge network
• publish the stable network alias memory_engine_proxy while keeping the API, Postgres, Redis, and MinIO private
• document the co-hosted ingress deployment and verification flow
• validate the merged base + overlay Compose model in GitHub Actions

Why

On a server shared with another containerized public ingress, binding the Memory Engine proxy to localhost does not make it reachable from the ingress container. The existing public_edge bridge was unused, leaving memory.creatempls.org without a durable upstream path. This overlay supports a single public TLS terminator while preserving Memory Engine's own Caddy request limits and security headers.

Impact

The default standalone deployment is unchanged. Operators opt in explicitly with:

docker compose -f docker-compose.yml -f docker-compose.public-edge.yml up -d --build proxy

Validation

• parsed the base Compose file, overlay, and workflow YAML
• asserted that only proxy joins public_edge as memory_engine_proxy
• sh -n scripts/*.sh api/entrypoint.sh
• git diff --check
• GitHub Actions validates the exact merged Compose configuration

[bseverns]

Maintainer review completed against commit 4c17f89: no blocking findings. Verified that the overlay is opt-in, only the Caddy proxy service joins external public_edge, the stable alias is memory_engine_proxy, and API/storage services remain private. Documentation and CI cover the intended merged Compose deployment.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c17f89818

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove inherited public port bindings from shared-edge overlay

When this overlay is used with the documented command and the default .env, the base proxy service still publishes host ports 80 and 443; this overlay only adds a network. On the intended co-hosted setup, the outer ingress normally already owns those ports, so up fails with a port-allocation conflict rather than serving through memory_engine_proxy. Clear or override proxy.ports in this overlay (and validate the rendered ports in CI) so the shared-network path actually avoids host port publication.

Useful? React with 👍 / 👎.