git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.
deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
Adds handle_path /_plantuml/* in git.hubris.network that rewrites to
/plantuml{uri} and proxies to 192.168.8.205:8079 (plantuml-server
docker container on LXC 105). Used by gitea footer.tmpl to render
PlantUML markdown code blocks without hitting the public demo server.
