ops: paivana and caddy config refresh

configs/cryptpad/README.md

@@ -0,0 +1,32 @@
+# CryptPad — on CachyOS (koopa)
+
+| Item | Value |
+|------|--------|
+| Stack | [CryptPad](https://cryptpad.org/) |
+| Image | `localhost/koopa-cryptpad:cachyos` |
+| Live dir | `/home/hernani/koopa-cryptpad/` |
+| Host port | **9030** = Paivana paywall; nginx edge backend **127.0.0.1:19130** → app |
+| App ports (internal) | **3000** HTTP, **3003** websocket |
+| Public site | `cryptpad.hacktivism.ch` |
+
+`websocketPort` must differ from `httpPort` (upstream default 3003). Compose runs `koopa-cryptpad-edge` (nginx) so Caddy still only targets **9030**.  
+Upstream wants a separate **safe/sandbox** origin for some builds — add a second vhost after first boot if the admin UI requires it.
+
+## Build + up
+
+```bash
+bash /path/to/koopa-admin-log/scripts/cryptpad/build.sh
+mkdir -p ~/koopa-cryptpad
+cp -a /path/to/koopa-admin-log/configs/cryptpad/{compose.yml,config.example.js} ~/koopa-cryptpad/
+cp ~/koopa-cryptpad/config.example.js ~/koopa-cryptpad/config.js
+# edit httpUnsafeOrigin / httpSafeOrigin in config.js
+cd ~/koopa-cryptpad && podman-compose up -d
+```
+
+## Caddy
+
+```bash
+sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
+  --snippet …/configs/caddy/cryptpad.hacktivism.ch.caddy \
+  --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
+```