Initial madcat-caddy: Caddy + Cloudflare DNS + caddy-security

Forked from tengu-apps/tengu-caddy, adding:
- caddy-security plugin (OAuth 2.0, Basic Auth, JWT)
- Gitea apt registry publishing in CI
- Linux-only builds (arm64 + amd64)
- Replaces/conflicts with caddy and tengu-caddy packages

debian/caddy.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Caddy web server (madcat-caddy)
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+LimitNPROC=512
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

debian/conffiles

@@ -0,0 +1 @@
+/etc/caddy/Caddyfile

debian/control

@@ -0,0 +1,12 @@
+Package: madcat-caddy
+Version: {{VERSION}}
+Architecture: {{ARCH}}
+Maintainer: madcat-os <madcat@saiden.dev>
+Description: Caddy web server with Cloudflare DNS and caddy-security plugins
+ Custom Caddy build with Cloudflare DNS-01 ACME challenge support
+ and caddy-security (OAuth 2.0, Basic Auth, JWT authorization).
+ Provides GitHub OAuth + Basic Auth gateway capabilities.
+Section: web
+Priority: optional
+Conflicts: caddy
+Replaces: caddy, tengu-caddy

debian/postinst

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -e
+
+# Create caddy user/group if they don't exist
+if ! getent group caddy >/dev/null 2>&1; then
+    groupadd --system caddy
+fi
+
+if ! getent passwd caddy >/dev/null 2>&1; then
+    useradd --system --gid caddy --create-home --home-dir /var/lib/caddy --shell /usr/sbin/nologin caddy
+fi
+
+# Create config and data directories
+mkdir -p /etc/caddy
+mkdir -p /var/lib/caddy/.config/caddy
+mkdir -p /var/lib/caddy/.local/share/caddy
+chown -R caddy:caddy /var/lib/caddy
+
+# Enable and start the service
+if [ -d /run/systemd/system ]; then
+    systemctl daemon-reload
+    systemctl enable caddy.service
+    systemctl start caddy.service || true
+fi

debian/postrm

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "purge" ]; then
+    rm -rf /etc/caddy
+    rm -rf /var/lib/caddy
+    userdel caddy 2>/dev/null || true
+    groupdel caddy 2>/dev/null || true
+fi
+
+if [ -d /run/systemd/system ]; then
+    systemctl daemon-reload
+fi

debian/prerm

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+if [ -d /run/systemd/system ]; then
+    systemctl stop caddy.service || true
+    systemctl disable caddy.service || true
+fi