Expand public installation and API documentation

examples/Caddyfile

@@ -0,0 +1,23 @@
+{
+    # caddy-opnsense-blocker expects the default JSON access log format.
+    # If Caddy is itself behind another proxy, make sure request.client_ip
+    # contains the real client address before you feed logs to the blocker.
+}
+
+example.com {
+    log {
+        output file /var/log/caddy/public-web-access.json
+        format json
+    }
+
+    reverse_proxy 127.0.0.1:8080
+}
+
+git.example.com {
+    log {
+        output file /var/log/caddy/gitea-access.json
+        format json
+    }
+
+    reverse_proxy 127.0.0.1:3000
+}

examples/caddy-opnsense-blocker.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=Caddy OPNsense Blocker
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=blocker
+Group=blocker
+SupplementaryGroups=caddy
+WorkingDirectory=/var/lib/caddy-opnsense-blocker
+ExecStart=/usr/local/bin/caddy-opnsense-blocker -config /etc/caddy-opnsense-blocker/config.yaml
+Restart=always
+RestartSec=5s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+ReadWritePaths=/var/lib/caddy-opnsense-blocker
+ReadOnlyPaths=/etc/caddy-opnsense-blocker /var/log/caddy
+
+[Install]
+WantedBy=multi-user.target