Build Housecarl 0.1.0: the nftables firewall manager

Zones, address sets (IPv4 and IPv6 mixed, dynamic sets with timeouts) and
services, ordered rules in the early, input, forward and output chains,
port forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
and switchable built-ins (loopback, conntrack, ICMPv6, antispoofing, MSS
clamping, DHCPv6 client, flowtable). Every change is validated, checked
with nft -c and applied in one transaction to Housecarl's own table,
inet housecarl; changes made over the network roll back unless
confirmed, and the confirmed ruleset is loaded at boot by
housecarl-ruleset.service. An empty configuration applies nothing.

Also: hit counters and the drop log (nflog), 'hc import' of an existing
nftables ruleset and 'hc takeover', the hc CLI, the REST API and the web
UI, users, scoped tokens (sets:write:NAME), the audit log, the web UI's
certificate through Jarl, Debian packages, docs, unit tests with real
nft 1.1.3, and an e2e test with real traffic (71 checks).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,69 @@
+# Builds and publishes a release when a version tag (v0.2.0, v1.0.0-rc.1)
+# is pushed:
+#   * a Gitea release with the CHANGELOG notes, the linux tarballs, the CLI
+#     for Linux, macOS and Windows, the .debs and SHA256SUMS;
+#   * the .debs (amd64, arm64) in the owner's Debian package registry:
+#     distribution "stable", or "testing" for a pre-release (a version
+#     with a hyphen), which Gitea also marks as a pre-release.
+#
+# Needs a repository secret RELEASE_TOKEN: an access token of a user who
+# can write to the repository, with the write:repository and write:package
+# scopes. docs/development.md ("Releasing") has the steps.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Check the tag against VERSION and CHANGELOG.md
+        run: |
+          version=$(cat VERSION)
+          if [ "$GITHUB_REF_NAME" != "v$version" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match VERSION ($version)"
+            exit 1
+          fi
+          # The release notes (a pre-release may use its final version's
+          # section or Unreleased; see scripts/gitea-release.sh).
+          if ! scripts/gitea-release.sh notes > /dev/null; then
+            echo "::error::no release notes for $version in CHANGELOG.md"
+            exit 1
+          fi
+
+      - name: Tools
+        run: |
+          missing=
+          for t in jq dpkg-deb curl; do command -v $t >/dev/null || missing="$missing $t"; done
+          if [ -n "$missing" ]; then
+            sudo=; [ "$(id -u)" = 0 ] || sudo=sudo
+            $sudo apt-get update -qq && $sudo apt-get install -y -qq jq dpkg curl
+          fi
+
+      - name: Test
+        run: make test
+
+      - name: Build
+        env:
+          # Checked against VERSION above; don't depend on the checkout
+          # having the tag.
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          export DEB_MAINTAINER="$(git log -1 --format='%an <%ae>')"
+          make dist
+          make cli-dist
+          make deb DEB_ARCH=amd64
+          make deb DEB_ARCH=arm64
+
+      - name: Publish
+        env:
+          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: scripts/gitea-release.sh