contacts: Contrack as the robust contacts (C3), picked in Settings or the setup wizard

Spec 11 §4: contacts.provider and contacts.contrack (local address only, company token
write-only), each person's own token (users.contrack_token_enc, migration 0010) in My settings,
books read from Contrack with a 5-minute cache, Add to contacts and accepted shares created in
Contrack, the company account on desk phones. Setup wizard step 8 Contacts. deploy/contrack
(2.0.2, pinned), Caddy/nginx blocks, decision 0003, admin guide Contacts. Tested against a fake
and a real Contrack 2.0.2 (contrack-live.test.ts).

deploy/caddy/Caddyfile

@@ -8,3 +8,10 @@
 		reverse_proxy 127.0.0.1:8080
 	}
 }
+
+# Contrack (spec 11 §4), when you run deploy/contrack: uncomment, and set CONTRACK_HOSTNAME in .env
+# (its own DNS name; Contrack can't live under a path).
+# {$CONTRACK_HOSTNAME} {
+# 	encode zstd gzip
+# 	reverse_proxy 127.0.0.1:3210
+# }

deploy/contrack/compose.yml

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Contrack (spec 11 §4, admin guide: Contacts): the "Robust" contacts, its own stack beside the PBX
+# on the same server. Contrack is a separate open source program (AGPL-3.0) we talk to over HTTP.
+#
+#   docker compose --env-file .env -f deploy/contrack/compose.yml up -d
+#
+# It listens on 127.0.0.1 only: the PBX (host networking) reaches it there, and people reach it
+# through the reverse proxy at CONTRACK_HOSTNAME (deploy/caddy/Caddyfile, deploy/nginx).
+# Then Settings → Contacts → Contrack, address http://127.0.0.1:3210.
+services:
+  contrack:
+    # Pinned: SelfPhoneNG is tested against this version's API (decision 0003).
+    image: ghcr.io/arvarik/contrack:2.0.2
+    restart: unless-stopped
+    ports: ['127.0.0.1:3210:3210']
+    environment:
+      AUTH_REQUIRED: 'true' # everyone signs in; tokens need it
+      TRUST_PROXY_HOPS: '1'
+      PUBLIC_URL: https://${CONTRACK_HOSTNAME:?set CONTRACK_HOSTNAME in .env}
+      # Contrack's own AI and address lookups are outside SelfPhoneNG's "nothing leaves the
+      # server" rule. Uncomment to keep everything here (or point its AI at your local Ollama in
+      # Contrack's Settings → AI):
+      # AI_DISABLED: 'true'
+      # GEOCODING_DISABLED: 'true'
+    volumes:
+      - contrack-data:/app/data # its database, uploads and its own backups: back this up too
+    logging:
+      driver: json-file
+      options: { max-size: 10m, max-file: '3' }
+
+volumes:
+  contrack-data:

deploy/nginx/selfphoneng.conf.example

@@ -45,3 +45,19 @@ server {
         proxy_read_timeout 3600s;
     }
 }
+
+# Contrack (spec 11 §4), when you run deploy/contrack: its own name (it can't live under a path).
+# server {
+#     listen 443 ssl;
+#     http2 on;
+#     server_name contacts.example.com;
+#     ssl_certificate     /etc/letsencrypt/live/contacts.example.com/fullchain.pem;
+#     ssl_certificate_key /etc/letsencrypt/live/contacts.example.com/privkey.pem;
+#     client_max_body_size 50m;     # contact imports and attachments
+#     location / {
+#         proxy_pass http://127.0.0.1:3210;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }