fix(nextcloud): pin cloud.hubris.network to LAN caddy IP in compose

Without this, the docker default resolver forwards the lookup to the
host gateway, which returns the public IONOS VPS IP. cloud.hubris is
not in the VPS traefik exposure list, so TLS handshakes during
WebDAV calls die with httpx.ConnectError: SSL UNEXPECTED_EOF.

extra_hosts pins it to caddy on 192.168.8.175, which holds the
cloud.hubris.network cert and proxies to the Nextcloud LXC. Applied
to every service for symmetry; only backend currently makes the
WebDAV calls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -12,6 +12,14 @@ services:
       - backend
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   backend:
@@ -98,6 +106,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   # ── Celery workers ─────────────────────────────────────────────────────
@@ -163,6 +179,14 @@ services:
       start_period: 120s
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   # Dedicated watcher worker — runs the long-lived watch_folders task
@@ -197,6 +221,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   worker-vision:
@@ -263,6 +295,14 @@ services:
         condition: service_healthy
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
 
   db:
@@ -276,6 +316,14 @@ services:
       - pg_data:/var/lib/postgresql/data
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U mulita -d mulita"]
@@ -294,6 +342,14 @@ services:
       - redis_data:/data
     networks:
       - mulita-network
+    # Pin cloud.hubris.network to the LAN caddy IP. Without this, the
+    # docker DNS forwards the lookup to the host's resolver, which
+    # returns the public IONOS VPS IP — but cloud isn't in the VPS
+    # traefik exposure list, so TLS handshakes against it die with
+    # "unexpected eof while reading". Caddy on 192.168.8.175 holds the
+    # cloud.hubris.network cert and proxies to the Nextcloud LXC.
+    extra_hosts:
+      - "cloud.hubris.network:192.168.8.175"
     restart: unless-stopped
     command: redis-server --appendonly yes
     healthcheck: