feat(hetzner): add restricted release hosting and update CI

servers/hetzner/modules/services/backup.nix

@@ -89,4 +89,4 @@ in {
     requires = ["restic-password.service"];
     after = ["restic-password.service"];
   };
-}
+}

servers/hetzner/modules/services/caddy.nix

@@ -1,7 +1,4 @@
-{
-  unstablePkgs,
-  ...
-}: let
+{unstablePkgs, ...}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
@@ -30,6 +27,13 @@ in {
         @notvpn not remote_ip 10.8.0.0/24
         respond @notvpn "Forbidden" 403
       }
+      # Restrict access to the server itself (loopback + public IPs) or the
+      # WireGuard VPN. Gitea reaches this from the server when publishing a
+      # release, and VPN clients can download from it; the public cannot.
+      (release_gate) {
+        @deny not remote_ip 127.0.0.1 ::1 10.8.0.0/24 49.13.92.205 2a01:4f8:c014:2585::1
+        respond @deny "Forbidden" 403
+      }
       # Security headers applied to every response of every site that
       # imports this snippet (covers all current and future hosts).
       # For proxied hosts whose upstream sets its own copies, strip them
@@ -245,6 +249,16 @@ in {
         '';
       };
 
+      "releases.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import release_gate
+          root * /srv/releases
+          file_server browse
+          encode zstd gzip
+        '';
+      };
+
       "http://ip.severijnse.eu" = {
         extraConfig = ''
           import security_headers
@@ -259,5 +273,6 @@ in {
   systemd.tmpfiles.rules = [
     "d /srv 0755 caddy caddy -"
     "d /srv/jory 0755 caddy caddy -"
+    "d /srv/releases 0755 admin caddy -"
   ];
 }

servers/hetzner/modules/services/stalwart.nix

@@ -85,7 +85,10 @@ in {
       session.auth.mechanisms = "[plain]";
       session.auth.directory = "'internal'";
       session.auth.require = [
-        {"if" = "listener != 'smtp'"; "then" = true;}
+        {
+          "if" = "listener != 'smtp'";
+          "then" = true;
+        }
         {"else" = false;}
       ];
 
@@ -182,4 +185,4 @@ in {
   systemd.tmpfiles.rules = [
     "d /var/lib/bulwark 0755 1001 1001 - -"
   ];
-}
+}

servers/hetzner/modules/services/wireguard.nix

@@ -7,7 +7,7 @@
     ];
     environment = {
       WG_HOST = "severijnse.eu";
-      PASSWORD_HASH = "$2a$12$b3n4drXgS3B6ubMZxxjPUOQ1XktZ1EuDwm4AIdVulhtoD7b1.WQGC";
+      PASSWORD_HASH = "$2a$14$f6l9jto2Uwn9hNudNo7cHeq08M8UDYzrUiOofWSH522QDRhgTlddC";
       WG_DEFAULT_ADDRESS = "10.8.0.x";
       WG_DEFAULT_DNS = "1.1.1.1";
       WG_PORT = "51820";