fix(infra): move Redis to prod, fix LibreTranslate config loading

- Add Redis sidecar to prod docker-compose; backend connects locally (redis:6379)
- Caddy layer4 now proxies redis.libnovel.cc:6380 → local redis:6379 (not homelab LAN)
- Remove HOMELAB_REDIS_ADDR; homelab runner connects out to prod Redis via rediss://
- Remove local Redis from homelab runner compose; drop redis_data volume
- Fix config.Load() missing LibreTranslate section — LIBRETRANSLATE_URL was never read

docker-compose.yml

@@ -126,6 +126,26 @@ services:
       timeout: 5s
       retries: 5
 
+  # ─── Redis (Asynq task queue — accessed locally by backend, remotely by homelab runner) ──
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: >
+      redis-server
+      --appendonly yes
+      --requirepass "${REDIS_PASSWORD}"
+    # No public port — backend reaches it via internal network.
+    # Homelab runner reaches it via Caddy TLS proxy on :6380 → redis:6379.
+    expose:
+      - "6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
   # ─── Backend API ──────────────────────────────────────────────────────────────
   backend:
     image: kalekber/libnovel-backend:${GIT_TAG:-latest}
@@ -151,6 +171,8 @@ services:
         condition: service_healthy
       valkey:
         condition: service_healthy
+      redis:
+        condition: service_healthy
     # No public port — all traffic is routed via Caddy.
     expose:
       - "8080"
@@ -164,10 +186,9 @@ services:
       GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
       OTEL_EXPORTER_OTLP_ENDPOINT: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
       OTEL_SERVICE_NAME: "backend"
-      # Asynq task queue — backend enqueues jobs to homelab Redis via Caddy TLS proxy.
-      # Set to "rediss://:password@redis.libnovel.cc:6380" in Doppler prd config.
-      # Leave empty to fall back to PocketBase polling.
-      REDIS_ADDR: "${REDIS_ADDR}"
+      # Asynq task queue — backend enqueues jobs to local Redis sidecar.
+      # Homelab runner connects to the same Redis via Caddy TLS proxy on :6380.
+      REDIS_ADDR: "redis:6379"
       REDIS_PASSWORD: "${REDIS_PASSWORD}"
     healthcheck:
       test: ["CMD", "/healthcheck", "http://localhost:8080/health"]
@@ -382,12 +403,10 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp" # HTTP/3 (QUIC)
-      - "6380:6380"   # Redis TCP proxy (TLS) for homelab → Asynq
+      - "6380:6380"   # Redis TCP proxy (TLS) for homelab runner → Asynq
     environment:
       DOMAIN: "${DOMAIN}"
       CADDY_ACME_EMAIL: "${CADDY_ACME_EMAIL}"
-      # Homelab Redis address — Caddy TCP-proxies inbound :6380 to this.
-      HOMELAB_REDIS_ADDR: "${HOMELAB_REDIS_ADDR:?HOMELAB_REDIS_ADDR required for Redis TCP proxy}"
     env_file:
       - path: ./crowdsec/.crowdsec.env
         required: false
@@ -421,6 +440,7 @@ volumes:
   pb_data:
   meili_data:
   valkey_data:
+  redis_data:
   caddy_data:
   caddy_config:
   caddy_logs: