feat(nh3-svos): mesh-only front door for svos.phasefinal.com (Caddy + WhoIs fail-closed auth), headscale extra record

configs/svos-front/caddy-svos.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=SVOS front door (Caddy, tailnet-only, svos.phasefinal.com) - eshpfi configs/svos-front
+After=network-online.target tailscaled.service svos-whois-auth.service
+Wants=network-online.target tailscaled.service svos-whois-auth.service
+
+[Service]
+User=caddy
+Group=caddy
+EnvironmentFile=/etc/caddy/env
+ExecStart=/usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/caddy
+Environment=XDG_DATA_HOME=/var/lib/caddy XDG_CONFIG_HOME=/var/lib/caddy
+# the tailnet address may not exist yet right after boot: keep retrying the bind
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target