ops: paivana and caddy config refresh

scripts/notes/prepare-basicauth-seed.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Copy silverbullet basicauth SoT → /tmp seed for apply-notes-basicauth.sh.
+# Run on magikoopa (or any host with unlocked koopa-admin-secrets-enc).
+# Does NOT touch /etc/caddy (no sudo). Does NOT print secret contents.
+#
+#   bash scripts/notes/prepare-basicauth-seed.sh
+#   # then on koopa (after scp seed or shared path):
+#   sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
+#     bash …/scripts/caddy/apply-notes-basicauth.sh
+set -euo pipefail
+
+OUT="${NOTES_AUTH_SEED_OUT:-/tmp/silverbullet-basicauth-seed.txt}"
+SOT_DEFAULT="${HOME}/git/koopa-admin-secrets-enc/koopa/home-hernani/caddy/silverbullet-basicauth.txt"
+SOT="${NOTES_AUTH_SOT:-$SOT_DEFAULT}"
+
+[[ -f "$SOT" ]] || {
+  echo "ERROR: missing SoT $SOT (unlock git-crypt / set NOTES_AUTH_SOT=)" >&2
+  exit 1
+}
+
+umask 077
+cp -a "$SOT" "$OUT"
+chmod 600 "$OUT"
+echo "STATUS=ok OUT=$OUT BYTES=$(wc -c <"$OUT" | tr -d ' ') NEXT=scp_or_use_NOTES_AUTH_SEED"
+echo "STATUS=hint scp $OUT hernani@koopa:/tmp/ && sudo NOTES_AUTH_SEED=$OUT bash …/apply-notes-basicauth.sh"