Set up a Bazel remote cache backed by a gRPC or HTTP server

Steps

1. Choose a cache backend: bazel-remote (open source, supports both HTTP and gRPC) is a common self-hosted option; managed alternatives include BuildBuddy and Engflow which expose grpcs:// endpoints
2. Run bazel-remote with a data directory and cache size limit: bazel-remote --dir /data/bazel-cache --max_size 50 --grpc_address 0.0.0.0:9092 --http_address 0.0.0.0:8080
3. Add remote cache flags to your .bazelrc: build --remote_cache=grpc://CACHE_HOST:9092 (or http://CACHE_HOST:8080 for HTTP); use grpcs:// and supply --tls_certificate for TLS
4. To allow the cache to be populated by CI and read by local dev, add build --remote_upload_local_results=true in CI and build --noremote_upload_local_results in developer .bazelrc.user to make CI the source of truth
5. Add build --remote_timeout=30 and build --remote_retries=3 to handle transient network failures gracefully without breaking local builds
6. Verify cache hits by running bazel build //... --execution_log_json_file=/tmp/exec.log and checking the remoteCacheHit field in the log entries