Initial madcat-caddy: Caddy + Cloudflare DNS + caddy-security

Forked from tengu-apps/tengu-caddy, adding:
- caddy-security plugin (OAuth 2.0, Basic Auth, JWT)
- Gitea apt registry publishing in CI
- Linux-only builds (arm64 + amd64)
- Replaces/conflicts with caddy and tengu-caddy packages

.github/workflows/build.yml

@@ -0,0 +1,106 @@
+name: Build and Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  CADDY_PLUGINS: "github.com/caddy-dns/cloudflare@v0.2.4&p=github.com/greenpau/caddy-security@v1.1.62"
+
+jobs:
+  build-deb:
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build .deb package
+        run: make deb ARCH=${{ matrix.arch }}
+
+      - name: Upload deb artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: madcat-caddy-deb-${{ matrix.arch }}
+          path: build/*.deb
+
+  build-binaries:
+    strategy:
+      matrix:
+        include:
+          - os: linux
+            arch: amd64
+            asset: madcat-caddy-linux-amd64
+          - os: linux
+            arch: arm64
+            asset: madcat-caddy-linux-arm64
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download Caddy with plugins
+        run: |
+          curl -fsSL "https://caddyserver.com/api/download?os=${{ matrix.os }}&arch=${{ matrix.arch }}&p=${CADDY_PLUGINS}" \
+            -o ${{ matrix.asset }}
+          chmod +x ${{ matrix.asset }}
+          file ${{ matrix.asset }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset }}
+          path: ${{ matrix.asset }}
+
+  release:
+    needs: [build-deb, build-binaries]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: artifacts/*
+          generate_release_notes: true
+
+  publish-apt:
+    needs: [build-deb]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+
+    steps:
+      - name: Download deb artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Publish to Gitea Debian registry
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          for deb in artifacts/*.deb; do
+            echo "Publishing $(basename $deb)..."
+            curl --fail --user "madcat:${GITEA_TOKEN}" \
+              --upload-file "$deb" \
+              "https://repos.saiden.dev/api/packages/madcat-os/debian/pool/bookworm/main/upload"
+            echo " -> done"
+          done