ops: add Cloudflare R2 creds (backups + images, EU jurisdiction)

scripts/build-nanomq.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Build NanoMQ from source on Debian 12 (prebuilt .deb needs glibc 2.38).
+# No TLS in NanoMQ — Caddy terminates TLS, NanoMQ listens plain on localhost.
+set -uo pipefail
+export DEBIAN_FRONTEND=noninteractive
+VER=0.24.14
+
+echo "[0] remove broken prebuilt"
+apt-get remove -y nanomq >/dev/null 2>&1 || true
+rm -f /usr/local/bin/nanomq || true
+
+echo "[1] build deps"
+apt-get install -y -qq build-essential cmake git ninja-build >/dev/null 2>&1
+
+echo "[2] clone v$VER + submodules"
+cd /opt && rm -rf nanomq-src
+git clone --branch "$VER" --depth 1 https://github.com/nanomq/nanomq.git nanomq-src >/dev/null 2>&1
+cd nanomq-src
+git submodule update --init --recursive >/dev/null 2>&1
+
+echo "[3] cmake"
+mkdir -p build && cd build
+cmake -G Ninja -DCMAKE_BUILD_TYPE=Release .. >/tmp/nanomq-cmake.log 2>&1 || { echo "CMAKE FAIL:"; tail -25 /tmp/nanomq-cmake.log; exit 1; }
+echo "[4] ninja build (this takes a few min)"
+ninja >/tmp/nanomq-build.log 2>&1 || { echo "NINJA FAIL:"; tail -35 /tmp/nanomq-build.log; exit 1; }
+ninja install >/tmp/nanomq-install.log 2>&1 || { echo "INSTALL FAIL:"; tail -15 /tmp/nanomq-install.log; exit 1; }
+ldconfig
+
+echo "[5] verify"
+which nanomq && nanomq --version