docs: Ingress & HTTP overview

website/docs/1-overview.md

@@ -67,7 +67,7 @@ Docker containers running on different machines get **unique IP addresses** from
 The design and implementation were highly inspired by
 Talos [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/).
 
-### Managed DNS service
+### Managed DNS service (optional)
 
 Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.cluster.uncloud.run` for your public
 services through free [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service. You can deploy a service and
@@ -99,7 +99,7 @@ containers by their service names, `curl` service endpoints, or analyse traffic
 
 ## Getting started
 
-Install Uncloud CLI and deploy your first app in minutes:
+Install Uncloud CLI and deploy your first app:
 
 * [Install Uncloud CLI](./2-getting-started/1-install-cli.md)
 * [Deploy demo app](./2-getting-started/2-deploy-demo-app.md)

website/docs/3-concepts/1-ingress/1-overview.md

@@ -0,0 +1,23 @@
+---
+sidebar_label: Overview
+---
+
+# Ingress & HTTPS
+
+Uncloud uses [Caddy](https://caddyserver.com/) as its reverse proxy to handle incoming traffic, provide automatic HTTPS
+with [Let's Encrypt](https://letsencrypt.org/), and route requests to your services.
+
+## How it works
+
+Caddy runs as a global service `caddy` on every machine in your cluster, listening on the host ports 80 (HTTP) and 443
+(HTTPS).
+
+It's deployed during cluster initialisation (`uc machine init`) unless you use the `--no-caddy` flag.
+See [Managing Caddy](3-managing-caddy.md) for deployment and customisation instructions.
+
+When you [publish a service port](2-publishing-services.md), Uncloud automatically configures Caddy to:
+
+1. Listen for requests on the specified hostname (domain name).
+2. Automatically obtain and renew a TLS certificate from Let's Encrypt for HTTPS.
+3. Route traffic to the **healthy** service container(s).
+4. Load balance across healthy replicas if there are multiple.

website/docs/3-concepts/1-ingress/_category_.yaml

@@ -0,0 +1,4 @@
+label: Ingress & HTTPS
+collapsed: true # keep the category closed by default
+link:
+  type: generated-index

website/docs/3-concepts/_category_.yaml

@@ -0,0 +1,4 @@
+label: Concepts
+collapsed: false # keep the category open by default
+link:
+  type: generated-index