Initial commit: TRI bootstrap server

- Caddy HTTPS static file server config
- Tor hidden service (V3 onion) for anonymous access
- Bootstrap generation script (blk0001.dat + txleveldb + database)
- Dropbox upload script
- Systemd services (tor-bootstrap, caddy)
- Operator guide and verification script

systemd/tri-bootstrap-caddy.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Caddy web server for TRI Bootstrap
+After=network-online.target tor@tri-bootstrap.service
+Wants=network-online.target tor@tri-bootstrap.service
+
+[Service]
+Type=simple
+User=root
+Group=root
+ExecReload=/usr/bin/caddy reload --config /etc/caddy/tri-bootstrap-Caddyfile
+ExecStart=/usr/bin/caddy run --config /etc/caddy/tri-bootstrap-Caddyfile --adapter caddyfile
+Restart=on-failure
+RestartSec=5
+
+# Caddy needs to bind to ports 80 and 443
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# Hardening
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=yes
+ReadOnlyPaths=/etc/caddy/tri-bootstrap-Caddyfile
+ReadWritePaths=/var/log/tri-bootstrap
+
+[Install]
+WantedBy=multi-user.target