ops: paivana and caddy config refresh

configs/galene/Containerfile

@@ -0,0 +1,41 @@
+# koopa-galene — Galene SFU on CachyOS base
+# Build on koopa (x86_64):
+#   bash ~/koopa-admin-log/scripts/galene/build.sh
+#   → localhost/koopa-galene:cachyos
+#
+# Upstream no longer ships release tarballs; build from git tag/branch.
+
+ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
+FROM ${CACHYOS_IMAGE}
+
+ARG GALENE_REF=galene-0.96.3
+ARG GALENE_REPO=https://github.com/jech/galene.git
+
+ENV TZ=Europe/Zurich \
+    PATH=/usr/local/bin:$PATH \
+    GALENE_DATA=/data \
+    GOPATH=/tmp/go \
+    GOTOOLCHAIN=auto
+
+RUN pacman -Syu --noconfirm --needed \
+      bash curl ca-certificates catatonit tar git go \
+ && pacman -Scc --noconfirm \
+ && rm -rf /var/cache/pacman/pkg/* /tmp/*
+
+RUN set -eux \
+ && git clone --depth 1 --branch "$GALENE_REF" "$GALENE_REPO" /src/galene \
+ && cd /src/galene \
+ && CGO_ENABLED=0 go build -ldflags='-s -w' -o /usr/local/bin/galene . \
+ && test -x /usr/local/bin/galene \
+ && mkdir -p /opt/galene \
+ && cp -a /src/galene/static /opt/galene/static \
+ && rm -rf /src/galene /tmp/go /root/go /var/cache/pacman/pkg/*
+
+COPY entrypoint.sh /docker-entrypoint.sh
+RUN chmod 755 /docker-entrypoint.sh \
+ && mkdir -p /data/groups /data/recordings /data/data \
+ && ln -sfn /opt/galene/static /data/static
+
+EXPOSE 8443
+WORKDIR /data
+ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]

configs/galene/README.md

@@ -0,0 +1,36 @@
+# Galene — SFU on CachyOS (koopa)
+
+| Item | Value |
+|------|--------|
+| Stack | [Galene](https://galene.org/) |
+| Image | `localhost/koopa-galene:cachyos` (`FROM docker.io/cachyos/cachyos`) |
+| Build | Go from git tag `GALENE_REF` (default `galene-0.96.3`; no release tarballs) |
+| Live dir | `/home/hernani/koopa-galene/` |
+| Container | `koopa-galene` |
+| Host port | **9029** = Paivana paywall; Galene HTTP backend **127.0.0.1:19129** (`-insecure`) |
+| Public site | `galene.hacktivism.ch` |
+
+## Build + up (koopa)
+
+```bash
+bash /path/to/koopa-admin-log/scripts/galene/build.sh
+mkdir -p ~/koopa-galene && cp -a /path/to/koopa-admin-log/configs/galene/compose.yml ~/koopa-galene/
+cd ~/koopa-galene && podman-compose up -d
+```
+
+## Caddy
+
+```bash
+sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
+  --snippet /path/to/koopa-admin-log/configs/caddy/galene.hacktivism.ch.caddy \
+  --site galene.hacktivism.ch --port 9029 --label galene
+```
+
+DNS + VeciGate for the hostname; WebRTC UDP ports documented when first room is live.
+
+## Notes
+
+- Volume `./data` must not hide UI assets; entrypoint passes `-static /opt/galene/static`.
+- Example group: copy `groups/hacktivism.json.example` → `~/koopa-galene/data/groups/hacktivism.json` (change op password).
+- WebRTC UDP: compose publishes **10000–10099/udp**; set the same range in VeciGate DNAT → koopa. Entrypoint uses `-udp-range` (`GALENE_UDP_RANGE`).
+- Built-in TURN (`-turn auto`) logs `no public addresses` until the host has a reachable public/mapped address; fix UDP/NAT first, then re-check logs.

configs/galene/compose.yml

@@ -0,0 +1,30 @@
+# koopa-galene — Galene on CachyOS
+# Live: /home/hernani/koopa-galene/
+# Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos
+#
+# Public :9029 = koopa-paivana-galene (shared paivana image).
+# Backend loopback only — Paivana DEST → 127.0.0.1:19129 (HTTP -insecure).
+# WebRTC UDP: still published (see README / ports.md)
+services:
+  galene:
+    image: localhost/koopa-galene:cachyos
+    container_name: koopa-galene
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Zurich
+      - GALENE_UDP_RANGE=${GALENE_UDP_RANGE:-10000-10099}
+    volumes:
+      - ./data:/data
+      - ./entrypoint.sh:/docker-entrypoint.sh:ro
+    ports:
+      - "127.0.0.1:${BACKEND_PORT:-19129}:8443"
+      - "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp"
+    labels:
+      org.hacktivism.service: galene
+      org.hacktivism.host_port: "9029"
+      org.hacktivism.backend_port: "${BACKEND_PORT:-19129}"
+      org.hacktivism.site: galene.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.port_status: backend-19129-paywall-9029
+      org.hacktivism.image_base: cachyos
+

configs/galene/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443
+# with -insecure (TLS terminated at Caddy).
+# Static assets stay in the image (/opt/galene/static); the ./data volume must
+# not shadow them — pass -static explicitly.
+DATA="${GALENE_DATA:-/data}"
+STATIC="${GALENE_STATIC:-/opt/galene/static}"
+# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md).
+UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}"
+mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data"
+cd "$DATA"
+exec /usr/local/bin/galene \
+  -http "0.0.0.0:8443" \
+  -insecure \
+  -static "$STATIC" \
+  -udp-range "$UDP_RANGE" \
+  -data "$DATA/data" \
+  -groups "$DATA/groups" \
+  -recordings "$DATA/recordings" \
+  "$@"

configs/galene/groups/hacktivism.json.example

@@ -0,0 +1,7 @@
+{
+  "displayName": "hacktivism",
+  "public": true,
+  "op": [{"username": "op", "password": "changeme"}],
+  "presenter": [{}],
+  "other": []
+}