Public repos are now browsable/clonable anonymously (HTTPS) and over SSH,
proxied through the Hetzner VPS. Unlike other public apps this is
deliberately not behind the oauth2-proxy/Zitadel gate, since Forgejo
already enforces its own per-repo visibility. Root redirects to the
.profile landing page. Documents the REQUIRE_SIGNIN_VIEW gotcha and the
Zitadel OIDC redirect_uri fix needed whenever FORGEJO_DOMAIN changes.
GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
Self-hosted Git service (Postgres-backed) plus gitea-mirror for automatic
GitHub repo mirroring. Storage split follows the Paperless pattern: DB and
app config on local disk, git objects/LFS/attachments/avatars on the UNAS
forgejo_data share. Wired into the Makefile, root README, and UNAS NFS docs;
adds Caddy routes for git.<domain> and git-mirror.<domain>.
- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
- Add docker-compose-files/vaultwarden/ with template.yaml, .env.sample,
and README (LXC assigned 10.0.10.16, port 8800)
- Reorganise Caddyfile site blocks into VLAN 1 / VLAN 10 / VLAN 30 sections
matching the TRUSTED / IoT zone layout from docs/network/firewall-rules.md
- Sort VLAN 10 entries by IP; split into physical devices vs LXC Apps sub-sections
- Move zigbee from LAN section to VLAN 30 where it actually lives (10.0.30.5)
UniFi devices validate the Origin header on WebSocket upgrades and reject
connections where it doesn't match their own hostname, causing real-time
dashboard stats to show N/A. Add unifi-upstream snippet that strips Origin
before forwarding, and apply it to both udm and unas proxy blocks.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both use self-signed TLS backends so they get the office-admin-upstream
snippet (tls_insecure_skip_verify). Update firewall backend policy table
in network docs to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- switchlite8poe moved to 10.0.1.6
- tplink16de removed (device no longer exists)
- speedtest removed (no longer needed)
- Update firewall backend policy table in network docs to match
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
