Forgejo's displayed SSH clone URL comes from SSH_DOMAIN, which defaults
to "localhost" (not DOMAIN) when unset — completely unusable, and
DOMAIN itself would've been wrong anyway since it resolves through
Caddy's wildcard CNAME, which SSH can't traverse. Point it at the
dedicated forgejo.home.brianpooe.com A record instead.
Added a Technitium A record pointing at the Forgejo LXC directly
(SSH can't go through the Caddy wildcard CNAME), so git-over-SSH URLs
read ssh://git@forgejo.home.brianpooe.com/... instead of the raw IP.
All 5 hosts' remotes/SSH config updated to match.
Relocated LXC 114's own admin sshd to port 2200 (systemd ssh.socket
override) to free port 22 for Forgejo's git-SSH, dropping the ugly
:2222 from every clone URL. Updated the 5 hosts' remotes/SSH config
and the corresponding UniFi rules to match.
GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
ENABLE_INTERNAL_SIGNIN=false hides the password form; ENABLE_BASIC_AUTHENTICATION=false
blocks raw-password basic auth. PATs and SSH keys are unaffected.
Zitadel sends preferred_username == full email when no separate nickname
is set, which fails Forgejo's username validation and crashes before
ACCOUNT_LINKING=auto gets a chance to match the existing local account.
Self-hosted Git service (Postgres-backed) plus gitea-mirror for automatic
GitHub repo mirroring. Storage split follows the Paperless pattern: DB and
app config on local disk, git objects/LFS/attachments/avatars on the UNAS
forgejo_data share. Wired into the Makefile, root README, and UNAS NFS docs;
adds Caddy routes for git.<domain> and git-mirror.<domain>.
- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
The official grampsweb image works under /app, not /opt/gramps-web —
media/index/cache paths pointed at unmounted directories. OIDC is now
opt-in via GRAMPS_OIDC_ENABLED and all optional placeholders have
defaults so rendering works without an OIDC/email config.
Bind data/media/consume/export/trash from PAPERLESS_DATA_ROOT with
create_host_path: false so the stack refuses to start when the NFS
share is not mounted. Wire PAPERLESS_TRASH_DIR.
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
- Add docker-compose-files/vaultwarden/ with template.yaml, .env.sample,
and README (LXC assigned 10.0.10.16, port 8800)
- Reorganise Caddyfile site blocks into VLAN 1 / VLAN 10 / VLAN 30 sections
matching the TRUSTED / IoT zone layout from docs/network/firewall-rules.md
- Sort VLAN 10 entries by IP; split into physical devices vs LXC Apps sub-sections
- Move zigbee from LAN section to VLAN 30 where it actually lives (10.0.30.5)
Replaced light.kids_lambs group entity with explicit list of mpho_lamb
and hloni_lamb in sunset and 20:30 automations. Group multicast was
causing hloni to silently miss Zigbee commands; unicast to each bulb
individually ensures reliable delivery.
HA 2026 rejects color_temp (mireds) via the service API with 400 Bad
Request, silently breaking automation actions. Switch all color
parameters to color_temp_kelvin: 6500 (cool white) and 2200 (warm white).
Dims mpho_lamb to 10% warm at 02:00 as a night light, and replaces the
fixed 06:00 off trigger with a sun sunrise event so the light goes off
at actual daybreak year-round.
Creates a light group combining mpho_lamb and hloni_lamb, and sets up
four daily automations: on at sunset/18:00 (full cool white), warm dim
at 20:30, hloni off at 22:00, mpho off at 06:00 — all with fade transitions.
setup-homeassistant.sh now deploys automations.yaml alongside configuration.yaml.
- Add SLZB06_HOST and CADDY_HOST_IP stubs to root .env.sample so cp -n covers all required vars
- Remove dead :-10.0.15.5 default from ha_configuration.yaml (CADDY_HOST_IP is required; default was unreachable)
- Genericise CADDY_HOST_IP comment in ha_configuration.yaml (removed hardcoded personal IP)
- Default zigbee2mqtt pan_id and network_key to GENERATE (remove personal network credentials from public blueprint)
- Remove hardcoded device list from zigbee2mqtt_configuration.yaml (Z2M builds this on pairing)
- Clarify README installation steps: root .env path, missing-var behaviour for SLZB06_HOST and CADDY_HOST_IP
