ops: paivana and caddy config refresh

configs/cryptpad/Containerfile

@@ -0,0 +1,47 @@
+# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman
+# Build on koopa (x86_64):
+#   bash ~/koopa-admin-log/scripts/cryptpad/build.sh
+#   → localhost/koopa-cryptpad:cachyos
+#
+# App tree from upstream release tarball (not the official Debian-ish image).
+
+ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
+FROM ${CACHYOS_IMAGE}
+
+ARG CRYPTPAD_VERSION=2025.9.0
+ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz
+
+ENV TZ=Europe/Zurich \
+    PATH=/usr/local/bin:$PATH \
+    CRYPTPAD_HOME=/cryptpad
+
+RUN pacman -Syu --noconfirm --needed \
+      bash curl ca-certificates catatonit tar git \
+      nodejs npm \
+ && pacman -Scc --noconfirm \
+ && rm -rf /var/cache/pacman/pkg/* /tmp/*
+
+# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs.
+RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \
+ && mkdir -p /cryptpad \
+ && tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \
+ && rm -f /tmp/cryptpad.tgz \
+ && cd /cryptpad \
+ && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \
+ && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+ && git config --global url."https://".insteadOf "git://" \
+ && printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \
+ && (npm ci --omit=dev --allow-git=all --allow-remote=all \
+     || npm install --omit=dev --allow-git=all --allow-remote=all) \
+ && (npm run install:components || true) \
+ && rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/*
+
+COPY entrypoint.sh /docker-entrypoint.sh
+RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \
+             /cryptpad/blobstage /cryptpad/data/logs
+COPY config.example.js /cryptpad/config/config.js
+RUN chmod 755 /docker-entrypoint.sh
+
+EXPOSE 3000
+WORKDIR /cryptpad
+ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]