caddy-route53-deb

Builds a Debian package of Caddy with the homelab's required modules, then publishes it to a Forgejo Debian registry using a Forgejo Actions workflow.

What it does

• Finds the latest upstream Caddy tag from a mirror repo.
• Builds Caddy with Route53, Layer 4, tls.get_certificate.file, and the homelab's tls.get_certificate.file_pair support via xcaddy.
• Creates a .deb that installs the custom binary at /usr/lib/caddy/caddy-route53.
• Uses dpkg-divert to replace /usr/bin/caddy with a symlink to the custom binary.
• Uploads the package to the Forgejo Debian registry (skips if already uploaded).

Forgejo Actions workflow

Workflow file: .forgejo/workflows/build-on-latest-tag.yml.

Triggers

• Scheduled: 0 3 * * 1 (runner time; commonly UTC) — every Monday at 03:00.
• Manual: workflow_dispatch with inputs.
• Pushes to main which change the workflow file.

Inputs (manual dispatch)

• distributions: Debian distributions, comma-separated (default bookworm,trixie).
• component: Debian repo component (main, contrib, non-free, non-free-firmware; default main).
• revision: Debian revision (default 6). Increase to rebuild the same upstream version.

Required configuration

Set the following in your Forgejo project:

Repository secrets

• USERNAME_FORGEJO: username with permission to upload to the Debian registry.
• CADDY_ROUTE53_DEB_UPLOAD_TOKEN: personal access token or password for the above user.
• The token needs write:package scope. If the package owner is private, the token also needs access to that owner.

The workflow also uses:

• FORGEJO_BASE_URL: derived from ${{ github.server_url }}.
• FORGEJO_OWNER: derived from ${{ github.repository_owner }}.

Publish location

Uploads to:

${FORGEJO_BASE_URL}/api/packages/${FORGEJO_OWNER}/debian/pool/<dist>/<component>/upload

A 409 response is treated as “already exists” and skipped.

Package behavior

• Installs caddy-route53 to /usr/lib/caddy/caddy-route53.
• Diverts /usr/bin/caddy to /usr/bin/caddy.distrib.
• Symlinks /usr/bin/caddy → /usr/lib/caddy/caddy-route53.
• Triggers a systemctl try-restart caddy.service on install/remove (best-effort).

Local build (optional)

If you want to run the same steps manually, you’ll need:

• Go (matching the workflow image, currently golang:1.25-bookworm)
• git, curl, dpkg-dev, ca-certificates

The workflow script is the canonical reference; see .forgejo/workflows/build-on-latest-tag.yml.

Notes

• This package depends on caddy and replaces the binary via dpkg-divert.
• The workflow expects the Forgejo Debian registry to be enabled for the owner/namespace.
• Layer 4 config uses the layer4 app and related modules from github.com/mholt/caddy-l4.
• tls.get_certificate.file_pair is published at github.com/art12354/caddy-tls-file-pair. Package builds pin its v0.2.0 release; Forgejo retains the development origin.
• Forgejo Git, API, and package traffic uses the runner host's Tailscale network namespace.