runner: Caddyfile for cache HTTPS frontend + README

runner/Caddyfile.example

@@ -0,0 +1,28 @@
+# Caddy snippet that serves the cargoxx binary cache over HTTPS.
+# Append to /etc/caddy/Caddyfile (or include via `import`) and reload:
+#   sudo systemctl reload caddy
+#
+# Caddy handles cert provisioning + renewal via ACME automatically.
+# Adjust the domain + the `root` path if the runner lives elsewhere.
+#
+# The cache is read-only here — writes happen exclusively from the
+# runner job container (`nix copy --to file:///srv/cargoxx-cache/store`).
+
+cache.cargoxx.amadey.xyz {
+	root * /home/mozart/cargoxx-pkgs/runner/cache/store
+	file_server browse=false
+
+	# narinfo / nar are immutable per content hash → cache aggressively.
+	@cache_immutable path *.narinfo *.nar.xz *.nar
+	header @cache_immutable Cache-Control "public, immutable, max-age=31536000"
+
+	# Substituter probe — short cache, must reflect new entries quickly.
+	@cache_info path /nix-cache-info
+	header @cache_info Cache-Control "public, max-age=300"
+
+	# Logs go to /var/log/caddy/cargoxx-cache.{access,error}.log by
+	# default; uncomment to override.
+	# log {
+	#     output file /var/log/caddy/cargoxx-cache.log
+	# }
+}