ops: add Cloudflare R2 creds (backups + images, EU jurisdiction)

scripts/build-nanomq.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Build NanoMQ from source on Debian 12 (prebuilt .deb needs glibc 2.38).
+# No TLS in NanoMQ — Caddy terminates TLS, NanoMQ listens plain on localhost.
+set -uo pipefail
+export DEBIAN_FRONTEND=noninteractive
+VER=0.24.14
+
+echo "[0] remove broken prebuilt"
+apt-get remove -y nanomq >/dev/null 2>&1 || true
+rm -f /usr/local/bin/nanomq || true
+
+echo "[1] build deps"
+apt-get install -y -qq build-essential cmake git ninja-build >/dev/null 2>&1
+
+echo "[2] clone v$VER + submodules"
+cd /opt && rm -rf nanomq-src
+git clone --branch "$VER" --depth 1 https://github.com/nanomq/nanomq.git nanomq-src >/dev/null 2>&1
+cd nanomq-src
+git submodule update --init --recursive >/dev/null 2>&1
+
+echo "[3] cmake"
+mkdir -p build && cd build
+cmake -G Ninja -DCMAKE_BUILD_TYPE=Release .. >/tmp/nanomq-cmake.log 2>&1 || { echo "CMAKE FAIL:"; tail -25 /tmp/nanomq-cmake.log; exit 1; }
+echo "[4] ninja build (this takes a few min)"
+ninja >/tmp/nanomq-build.log 2>&1 || { echo "NINJA FAIL:"; tail -35 /tmp/nanomq-build.log; exit 1; }
+ninja install >/tmp/nanomq-install.log 2>&1 || { echo "INSTALL FAIL:"; tail -15 /tmp/nanomq-install.log; exit 1; }
+ldconfig
+
+echo "[5] verify"
+which nanomq && nanomq --version

scripts/install-nanomq.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install NanoMQ from the latest GitHub release .deb (amd64).
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+api="https://api.github.com/repos/nanomq/nanomq/releases/latest"
+echo "[1] querying latest release…"
+debs=$(curl -fsSL "$api" | grep -oE 'https://[^" ]+\.deb')
+echo "all .deb assets:"; echo "$debs"
+url=$(echo "$debs" | grep -iE 'amd64|x86_64|x86-64' | grep -viE 'arm|aarch' | head -1)
+if [ -z "${url:-}" ]; then
+  echo "[!] no amd64 .deb in latest release; aborting"
+  exit 1
+fi
+echo "[2] downloading: $url"
+curl -fsSL -o /tmp/nanomq.deb "$url"
+echo "[3] installing…"
+apt-get install -y /tmp/nanomq.deb 2>&1 | tail -3
+rm -f /tmp/nanomq.deb
+echo "[4] version:"
+(nanomq --version 2>&1 | head -3) || (echo "binary at:"; dpkg -L nanomq | grep -E 'bin/nanomq$' || true)