Replace the separate CMS subdomain with path-based routing in Caddy:
/admin and /uploads go to Strapi, everything else to the frontend.
Strapi 5 nests its whole admin panel (UI and API) under /admin, so this
one prefix is enough and never collides with the frontend's own /api
routes. Drops CMS_DOMAIN and the unused STRAPI_URL env var on the cms
service; PUBLIC_STRAPI_URL now points at the same origin as the site.
Authentication is unchanged: Strapi's own admin login still gates the
panel, this only changes how it's reached.
The host's systemd-resolved stub (127.0.0.53) is unreachable from inside
the container network namespace, so Caddy could not resolve Let's Encrypt
endpoints. Point it at public resolvers instead.
The interface is translated through @nuxtjs/i18n: strings live in
i18n/locales/*.json, routes are prefixed except for the default English, and
useLocaleHead emits the lang attribute, the hreflang alternates and og:locale.
The switcher is a native select rather than a custom dropdown: keyboard
support, the platform picker on mobile and correct labelling come for free.
Article content stays single-language — this translates the site chrome only.
Production traffic enters through Caddy, which terminates TLS for the public
domain and the CMS subdomain and sets HSTS and the other security headers.
PostgreSQL, Strapi and Nuxt publish no ports of their own.
docker-compose.dev.yml publishes the ports on localhost and drops Caddy for
local testing. It is a separate file rather than an override.yml so it can only
be applied when passed explicitly, never by accident in production.
davide