Route public release storage domains

evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md

@@ -191,6 +191,10 @@ The same change also makes the forge itself the release authority: release tags
   - Publish `sparkle/<channel>/`, `sparkle/appcast.xml`, and `sparkle/default/` pointers from `publish-store-uploads`.
   - The macOS app embeds Sparkle and consumes the `https://releases.burrow.net/sparkle/appcast.xml` feed.
 - Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account.
+- Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy
+  edge as stable Burrow domains backed by the GCS release and package buckets.
+  Appcast enclosure URLs and package repository metadata must use those Burrow
+  domains instead of provider-specific object-storage URLs.
 
 ## Security and Operational Considerations
 

nixos/hosts/burrow-forge/default.nix

@@ -373,6 +373,22 @@ in
     reverse_proxy 127.0.0.1:3001
   '';
 
+  services.caddy.virtualHosts."releases.burrow.net".extraConfig = ''
+    encode gzip zstd
+    rewrite * /burrow-net-releases{uri}
+    reverse_proxy https://storage.googleapis.com {
+      header_up Host storage.googleapis.com
+    }
+  '';
+
+  services.caddy.virtualHosts."packages.burrow.net".extraConfig = ''
+    encode gzip zstd
+    rewrite * /burrow-net-packages{uri}
+    reverse_proxy https://storage.googleapis.com {
+      header_up Host storage.googleapis.com
+    }
+  '';
+
   services.burrow.headscale = {
     enable = true;
     oidcClientSecretFile = config.age.secrets.burrowHeadscaleOidcClientSecret.path;