setup.sh: fix wildcard Caddy block — use host label placeholder (host_regexp isn't a built-in matcher)

caddy validate failed: 'module not registered: http.matchers.host_regexp'.
Drop the regexp; map the subdomain via {http.request.host.labels.N} where N is
the DOMAIN label count. The on-demand ask endpoint still gates cert issuance to
registered members.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -381,7 +381,9 @@ fi
 # Let Caddy (user 'caddy') read the per-user public_html trees.
 usermod -aG "$SVC_USER" caddy 2>/dev/null || true
 log "writing Caddyfile"
-DOMAIN_RE=$(printf '%s' "$DOMAIN" | sed 's/[.]/\\./g')   # dots escaped for Caddy host_regexp
+# Caddy indexes host labels from the right (com=0, profullstack=1, bbs=2, …);
+# the user subdomain is the next label left, i.e. index = DOMAIN's label count.
+USER_LABEL_IDX=$(printf '%s' "$DOMAIN" | awk -F. '{print NF}')
 cat > /etc/caddy/Caddyfile <<CADDY
 {
 	email ${ACME_EMAIL}
@@ -427,16 +429,12 @@ ${DOMAIN} {
 	tls {
 		on_demand
 	}
-	@user host_regexp user ^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.${DOMAIN_RE}\$
-	handle @user {
-		root * ${DATA_DIR}/users/{re.user.1}/public_html
+	# Only registered members get an on-demand cert (the ask endpoint gates it),
+	# so {labels.${USER_LABEL_IDX}} is always a real user's public_html.
+	root * ${DATA_DIR}/users/{http.request.host.labels.${USER_LABEL_IDX}}/public_html
 	try_files {path} {path}/index.html
 	file_server browse
 }
-	handle {
-		respond "no such user" 404
-	}
-}
 
 # Custom domains a member pointed at this host (ssh domain@${DOMAIN} add ...).
 # The symlink farm in domains/ maps each host to its owner's public_html, so