GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
Removing Allow TRUSTED to TRUSTED Any broke SSH to Technitium,
proving UniFi custom zones do not get the default intra-zone allow.
Mark both intra-zone rules as required, not redundant.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Redundant rules to delete (TRUSTED to TRUSTED, IoT to IoT, CADDY to
Gateway DNS), the FAMILY to CADDY action fix, and a review table for
the direct Emby pinholes that bypass Caddy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Documents the missing and incorrect UniFi policies found during zone
policy review: FAMILY to CADDY action fix, all CADDY to TRUSTED backend
app policies, CADDY to IoT policies, and public DNS block policies per
zone.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
