Upgrade HeyForm from v0.1.0 to v3.0.5

v0.1.0 (Feb 2025) has dozens of published security advisories fixed in
v3. Tested against a copy of the database first; forms load unchanged.

v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8
commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now
https (v3's CORS allowlist is built from it), Caddy is the trusted proxy,
public sign-up is off, and integration credentials get their own key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/heyform-compose.yml.j2

@@ -1,19 +1,26 @@
 services:
   heyform:
-    image: heyform/community-edition:latest
+    # Pinned: v3 changed the port, paths and Redis requirements. Read the
+    # release notes before bumping.
+    image: heyform/community-edition:v3.0.5
     restart: always
     volumes:
       # Persist uploaded images
-      - assets:/app/static/upload
+      - assets:/app/packages/server/static/upload
     depends_on:
       - mongo
-      - keydb
+      - redis
     environment:
-      - APP_HOMEPAGE_URL=http://{{ subdomains.heyform }}
+      - APP_HOMEPAGE_URL=https://{{ subdomains.heyform }}
+      # Only Caddy may set X-Forwarded-For
+      - TRUST_PROXY={{ docker.hairpin_ip }}
+      # No public sign-up; new people join through workspace invitations
+      - APP_DISABLE_REGISTRATION=true
       - SESSION_KEY={{ vault_heyform.session_key }}
       - FORM_ENCRYPTION_KEY={{ vault_heyform.encryption_key }}
-      - MONGO_URI='mongodb://mongo:27017/heyform'
-      - REDIS_HOST=keydb
+      - INTEGRATION_ENCRYPTION_KEY={{ vault_heyform.integration_encryption_key }}
+      - MONGO_URI=mongodb://mongo:27017/heyform
+      - REDIS_HOST=redis
       - REDIS_PORT=6379
       - SMTP_FROM=nerderland@{{ email_domains.updates }}
       - SMTP_HOST={{ smtp.host }}
@@ -23,29 +30,32 @@ services:
       - SMTP_SECURE=true
 
   mongo:
+    # HeyForm's own compose files still use 4.4
     image: percona/percona-server-mongodb:4.4
     restart: always
     volumes:
       # Persist MongoDB data
       - database:/data/db
 
-  keydb:
-    image: eqalpha/keydb:latest
+  redis:
+    # v3 needs Redis 8 commands (HGETDEL), so KeyDB no longer works
+    image: redis:8-alpine
     restart: always
-    command: keydb-server --appendonly yes
+    command: redis-server --appendonly yes
+    labels:
+      mag37.dockcheck.update: true
     volumes:
-      # Persist KeyDB data
-      - keydb:/data
+      - redis:/data
 
 volumes:
   assets:
     driver: local
   database:
     driver: local
-  keydb:
+  redis:
     driver: local
 
 networks:
   default:
     external: true
-    name: {{ docker.network_name }}
+    name: {{ docker.network_name }}