ops: paivana and caddy config refresh

configs/galene/Containerfile

@@ -0,0 +1,41 @@
+# koopa-galene — Galene SFU on CachyOS base
+# Build on koopa (x86_64):
+#   bash ~/koopa-admin-log/scripts/galene/build.sh
+#   → localhost/koopa-galene:cachyos
+#
+# Upstream no longer ships release tarballs; build from git tag/branch.
+
+ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
+FROM ${CACHYOS_IMAGE}
+
+ARG GALENE_REF=galene-0.96.3
+ARG GALENE_REPO=https://github.com/jech/galene.git
+
+ENV TZ=Europe/Zurich \
+    PATH=/usr/local/bin:$PATH \
+    GALENE_DATA=/data \
+    GOPATH=/tmp/go \
+    GOTOOLCHAIN=auto
+
+RUN pacman -Syu --noconfirm --needed \
+      bash curl ca-certificates catatonit tar git go \
+ && pacman -Scc --noconfirm \
+ && rm -rf /var/cache/pacman/pkg/* /tmp/*
+
+RUN set -eux \
+ && git clone --depth 1 --branch "$GALENE_REF" "$GALENE_REPO" /src/galene \
+ && cd /src/galene \
+ && CGO_ENABLED=0 go build -ldflags='-s -w' -o /usr/local/bin/galene . \
+ && test -x /usr/local/bin/galene \
+ && mkdir -p /opt/galene \
+ && cp -a /src/galene/static /opt/galene/static \
+ && rm -rf /src/galene /tmp/go /root/go /var/cache/pacman/pkg/*
+
+COPY entrypoint.sh /docker-entrypoint.sh
+RUN chmod 755 /docker-entrypoint.sh \
+ && mkdir -p /data/groups /data/recordings /data/data \
+ && ln -sfn /opt/galene/static /data/static
+
+EXPOSE 8443
+WORKDIR /data
+ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]