Public repos are now browsable/clonable anonymously (HTTPS) and over SSH,
proxied through the Hetzner VPS. Unlike other public apps this is
deliberately not behind the oauth2-proxy/Zitadel gate, since Forgejo
already enforces its own per-repo visibility. Root redirects to the
.profile landing page. Documents the REQUIRE_SIGNIN_VIEW gotcha and the
Zitadel OIDC redirect_uri fix needed whenever FORGEJO_DOMAIN changes.
Relocated LXC 114's own admin sshd to port 2200 (systemd ssh.socket
override) to free port 22 for Forgejo's git-SSH, dropping the ugly
:2222 from every clone URL. Updated the 5 hosts' remotes/SSH config
and the corresponding UniFi rules to match.
Switched all internal hosts from HTTPS+token to SSH for git access to
Forgejo, using a shared deploy key. SSH bypasses Caddy (proxying raw
TCP isn't possible), so raspberrypi and Home Assistant each needed a
direct TRUSTED-zone rule to 10.0.10.18:2222.
Home Assistant now pulls homelab-blueprint from Forgejo through Caddy,
which needed both a UniFi zone rule (IoT -> CADDY) and a ufw allow on
the Caddy host itself for the IoT subnet — two independent enforcement
layers, both previously missing/misconfigured.
GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
Removing Allow TRUSTED to TRUSTED Any broke SSH to Technitium,
proving UniFi custom zones do not get the default intra-zone allow.
Mark both intra-zone rules as required, not redundant.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Redundant rules to delete (TRUSTED to TRUSTED, IoT to IoT, CADDY to
Gateway DNS), the FAMILY to CADDY action fix, and a review table for
the direct Emby pinholes that bypass Caddy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Documents the missing and incorrect UniFi policies found during zone
policy review: FAMILY to CADDY action fix, all CADDY to TRUSTED backend
app policies, CADDY to IoT policies, and public DNS block policies per
zone.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
