Answer "yes" to the reverse proxy question. Caddy then stays off, and the app listens on 127.0.0.1:3000.
Send every path of your domain to that address, for example with Caddy:
crm.example.com {
reverse_proxy 127.0.0.1:3000
}When your proxy runs in its own container, 127.0.0.1 is not the host. Set APP_BIND=0.0.0.0 in deploy/.env, block port 3000 in your firewall, and point the proxy at the host address. Then run docker compose up -d in the deploy folder.