feat(hetzner): add restricted release hosting and update CI

servers/hetzner/modules/services/caddy.nix

@@ -1,7 +1,4 @@
-{
-  unstablePkgs,
-  ...
-}: let
+{unstablePkgs, ...}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
@@ -30,6 +27,13 @@ in {
         @notvpn not remote_ip 10.8.0.0/24
         respond @notvpn "Forbidden" 403
       }
+      # Restrict access to the server itself (loopback + public IPs) or the
+      # WireGuard VPN. Gitea reaches this from the server when publishing a
+      # release, and VPN clients can download from it; the public cannot.
+      (release_gate) {
+        @deny not remote_ip 127.0.0.1 ::1 10.8.0.0/24 49.13.92.205 2a01:4f8:c014:2585::1
+        respond @deny "Forbidden" 403
+      }
       # Security headers applied to every response of every site that
       # imports this snippet (covers all current and future hosts).
       # For proxied hosts whose upstream sets its own copies, strip them
@@ -245,6 +249,16 @@ in {
         '';
       };
 
+      "releases.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import release_gate
+          root * /srv/releases
+          file_server browse
+          encode zstd gzip
+        '';
+      };
+
       "http://ip.severijnse.eu" = {
         extraConfig = ''
           import security_headers
@@ -259,5 +273,6 @@ in {
   systemd.tmpfiles.rules = [
     "d /srv 0755 caddy caddy -"
     "d /srv/jory 0755 caddy caddy -"
+    "d /srv/releases 0755 admin caddy -"
   ];
 }