feat: initial itpp-docs setup with MkDocs Material

- mkdocs.yml with dark slate theme, nav for 12 ITPP projects
- build-docs.sh aggregates docs from all project repos
- .gitea/workflows/docs-publish.yml for nightly rebuild+deploy
- README and CHANGELOG for the itpp-docs repo itself
- docs-source/ populated from all 12 repos
- site/ ready for deployment to docs.itpropartner.com

docs-source/itpp-infrastructure/app2-caddyfile-audit-2026-07-21.md

@@ -0,0 +1,27 @@
+# app2 Caddyfile Audit — July 21, 2026
+
+## Root cause
+Technitium DNS was deployed on app2. During the Caddyfile rewrite to add `dns1.itpropartner.com`, two existing services were dropped:
+
+1. **UNMS** — `reverse_proxy localhost:80` failed because UNMS nginx exposes port 443 (via host 8444), not port 80. Fixed by proxying via HTTPS with `tls_insecure_skip_verify`.
+2. **Gitea** — entry was completely removed. Fixed by adding `reverse_proxy 127.0.0.1:3001`.
+
+## Prevention
+- Always audit `docker ps` output BEFORE rewriting Caddyfile
+- Verify every running container that exposes web ports has a Caddy entry
+- Test each domain with `curl -sk` after Caddy reload
+
+## Final Caddyfile (validated)
+```
+{
+    default_bind 152.53.39.202
+    auto_https disable_redirects
+}
+dns1.itpropartner.com:443 → 127.0.0.1:5380
+gps.fleettracker360.com:443 → localhost:8082
+fleettracker360.com:443 → localhost:8082
+unms.forefrontwireless.com:443 → https://localhost:8444 (tls_insecure_skip_verify)
+unifi.itpropartner.com:443 → https://localhost:8443 (tls_insecure_skip_verify)
+hudu.itpropartner.com:443 → localhost:3000
+git.itpropartner.com:443 → 127.0.0.1:3001
+```