ops: paivana and caddy config refresh

configs/galene/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443
+# with -insecure (TLS terminated at Caddy).
+# Static assets stay in the image (/opt/galene/static); the ./data volume must
+# not shadow them — pass -static explicitly.
+DATA="${GALENE_DATA:-/data}"
+STATIC="${GALENE_STATIC:-/opt/galene/static}"
+# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md).
+UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}"
+mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data"
+cd "$DATA"
+exec /usr/local/bin/galene \
+  -http "0.0.0.0:8443" \
+  -insecure \
+  -static "$STATIC" \
+  -udp-range "$UDP_RANGE" \
+  -data "$DATA/data" \
+  -groups "$DATA/groups" \
+  -recordings "$DATA/recordings" \
+  "$@"