[matheus1lva]

Turns off HTTP/3 for the alerts API Caddy and documents the minimum Caddy version, in response to the QPACK amplification attack against HTTP/3 servers (FoxIO write-up).

Caddy uses quic-go and enables HTTP/3 (UDP 443) by default. quic-go's QPACK decoder can be abused for memory/CPU amplification: CVE-2025-64702 / GHSA-g754-hx8w-x2g6 (headers, fixed in 0.57.0) and the trailer variant GHSA-vvgj-x9jq-8cj9 (fixed in 0.59.1). Caddy 2.11.3+ ships quic-go 0.59.1 or newer; 2.10.x and 2.11.1/2.11.2 are still affected.

Changes

• deploy/Caddyfile: adds servers { protocols h1 h2 } to the existing global options block (kept email and the rate-limit comment), so Caddy only serves HTTP/1.1 and HTTP/2 over TCP. This GET-only internal API gets nothing from QUIC. The header now says Caddy >= 2.11.3 is required.
• deploy/alerts-api.md: notes the Caddy 2.11.3 minimum and a caddy version check in the install steps, and says UDP 443 should stay closed in the firewall.

Validation

caddy validate with the official Caddy v2.11.7 binary (checksum verified) and placeholder env vars: Valid configuration. caddy adapt shows "protocols": ["h1","h2"] on the server. (caddy fmt warns about a blank line after the header comment, which was already on main.)

Server-side steps (not covered by this PR)

1. On the Hetzner VPS, run caddy version. If it's below v2.11.3, upgrade from the official Caddy apt repo (latest is v2.11.7). Distro packages lag behind.
2. Deploy the new Caddyfile and run sudo systemctl reload caddy. A restart also works.
3. Optional: block UDP 443 in the Hetzner Cloud Firewall. Only TCP 22/80/443 need to be open.