ops: add Cloudflare R2 creds (backups + images, EU jurisdiction)

passwords.md

@@ -39,6 +39,17 @@ _Last updated: 2026-05-30 (new-VPS bring-up)._
 - API key: `sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9`  ⚠️ rotate (was in chat)
 - _TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit)._
 
+## Cloudflare R2 (object storage — backups + images)
+- Bucket: `cannabuddy`
+- S3 endpoint (default): `https://e840f5bb6d09cb2c0294f434f35642a9.r2.cloudflarestorage.com`
+- **S3 endpoint (EU jurisdiction — use this, GDPR):** `https://e840f5bb6d09cb2c0294f434f35642a9.eu.r2.cloudflarestorage.com`
+- Public/custom domain: `r2.cannabuddy.eu`
+- Region for S3 clients: `auto`
+- API token: `cfat_bL4s5zcL4PBZ648Wl2ud1km78uMpaRNLLao6qMfy9645f7e5`
+- Access Key ID: `e67b72e868242044374c382193f98aa8`
+- Secret Access Key: `6e6421e28386a163f0fe80167a50cb1bb18f3dc68786930e1dba80ea6583a57a`
+- Uses: nightly encrypted `pg_dump` backups → R2; later image uploads (presigned URLs).
+
 ## App secrets — to generate fresh on the new box (do NOT reuse old)
 - `DATABASE_URL` (TimescaleDB role + password) — _TODO_
 - Better-Auth secret (`BETTER_AUTH_SECRET`) — _TODO (openssl rand -hex 32)_

scripts/build-nanomq.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Build NanoMQ from source on Debian 12 (prebuilt .deb needs glibc 2.38).
+# No TLS in NanoMQ — Caddy terminates TLS, NanoMQ listens plain on localhost.
+set -uo pipefail
+export DEBIAN_FRONTEND=noninteractive
+VER=0.24.14
+
+echo "[0] remove broken prebuilt"
+apt-get remove -y nanomq >/dev/null 2>&1 || true
+rm -f /usr/local/bin/nanomq || true
+
+echo "[1] build deps"
+apt-get install -y -qq build-essential cmake git ninja-build >/dev/null 2>&1
+
+echo "[2] clone v$VER + submodules"
+cd /opt && rm -rf nanomq-src
+git clone --branch "$VER" --depth 1 https://github.com/nanomq/nanomq.git nanomq-src >/dev/null 2>&1
+cd nanomq-src
+git submodule update --init --recursive >/dev/null 2>&1
+
+echo "[3] cmake"
+mkdir -p build && cd build
+cmake -G Ninja -DCMAKE_BUILD_TYPE=Release .. >/tmp/nanomq-cmake.log 2>&1 || { echo "CMAKE FAIL:"; tail -25 /tmp/nanomq-cmake.log; exit 1; }
+echo "[4] ninja build (this takes a few min)"
+ninja >/tmp/nanomq-build.log 2>&1 || { echo "NINJA FAIL:"; tail -35 /tmp/nanomq-build.log; exit 1; }
+ninja install >/tmp/nanomq-install.log 2>&1 || { echo "INSTALL FAIL:"; tail -15 /tmp/nanomq-install.log; exit 1; }
+ldconfig
+
+echo "[5] verify"
+which nanomq && nanomq --version

scripts/install-nanomq.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install NanoMQ from the latest GitHub release .deb (amd64).
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+api="https://api.github.com/repos/nanomq/nanomq/releases/latest"
+echo "[1] querying latest release…"
+debs=$(curl -fsSL "$api" | grep -oE 'https://[^" ]+\.deb')
+echo "all .deb assets:"; echo "$debs"
+url=$(echo "$debs" | grep -iE 'amd64|x86_64|x86-64' | grep -viE 'arm|aarch' | head -1)
+if [ -z "${url:-}" ]; then
+  echo "[!] no amd64 .deb in latest release; aborting"
+  exit 1
+fi
+echo "[2] downloading: $url"
+curl -fsSL -o /tmp/nanomq.deb "$url"
+echo "[3] installing…"
+apt-get install -y /tmp/nanomq.deb 2>&1 | tail -3
+rm -f /tmp/nanomq.deb
+echo "[4] version:"
+(nanomq --version 2>&1 | head -3) || (echo "binary at:"; dpkg -L nanomq | grep -E 'bin/nanomq$' || true)