add pvelabs

README.md

@@ -52,6 +52,30 @@ deployment to Let's Encrypt:
 ./manage.sh start
 ```
 
+## Optional Guacamole proxy
+
+To expose a Guacamole service through the same Nginx and certificate, add these
+settings to the deployment `.env` before running the TLS bootstrap:
+
+```sh
+EXTERNAL_GUACAMOLE_ENABLED=true
+EXTERNAL_GUACAMOLE_DOMAIN=pvelabs.example.com
+EXTERNAL_GUACAMOLE_UPSTREAM=http://10.0.0.10:8080
+```
+
+The external address is served at the domain root while Nginx preserves
+Guacamole's native `/guacamole/` context path internally. `bootstrap` adds the
+hostname to the existing certificate (or creates it) and configures the
+required unbuffered WebSocket proxy:
+
+```sh
+./manage.sh bootstrap
+./manage.sh start
+```
+
+The backend origin must be reachable from the Nginx container. The proxy is
+available only with TLS enabled.
+
 ## Local checks
 
 ```sh