api no longer embeds the SPA (it's compose/web/Dockerfile's `web`
service in the oikos repo now) — route the catch-all handle to :8091
instead of :8090, and restore the /api/v1/*, /mcp, /agent/* matcher so
those keep hitting api directly rather than falling through to the
static file server.
Authentik-gated (matches paperless.hubris.network's pattern) since the
console handles real mutation actions (signal ack/resolve, approval
approve/deny) and doesn't implement its own network-level gating the
way mcp.hubris.network/secrets.hubris.network do.
See dtoro/Homelab-Docs oikos/console/ for the app itself.
Update the photos.hubris.network block to match the current stack
(PhotoPrism API + Go sidecar + SvelteKit). Add prism.hubris.network
as a dedicated PhotoPrism vhost for the Prismatic mobile client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Domain-level proxy providers (Paperless, qBit) need an external_host that
routes to the LAN outpost (192.168.8.6), not auth.hubris.network (now the VPS
core). New site sso.hubris.network -> reverse_proxy 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Forward-auth now validates against the VPS Authentik core via a dedicated
LAN outpost (auth-outpost LXC 106), not LXC 124's frozen embedded outpost.
Resolves the post-migration split-brain. 192.168.8.180:9000 -> 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Earlier commits (e535f93 + a52cf68) proxied /library/login through to
PhotoPrism to fix what I thought was the OIDC initiation path. Wrong:
the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login
(already routed via @pp). The /library/login URL is what PhotoPrism's
UI uses POST-OIDC for the localStorage handoff back to the SPA — it
MUST bounce to / via the caddy redir, otherwise the SPA never picks
up the session and the user lands in PhotoPrism's own UI.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Without an explicit route{} block, caddy auto-hoists `redir` ahead of
`reverse_proxy`. That meant /library/* still redirected to / even
though I'd placed an @pp_login reverse_proxy above the redirs in the
file. Wrap the whole site in route{} so directives run in source order
and the more-specific /library/login matcher wins before the broader
/library/* redir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The /library/* catch-all redir bounced /library/login (PhotoPrism's
OIDC login surface) back to / before the user could click "Sign in
with Authentik". Add a specific @pp_login matcher above the redir
so /library/login + /library/login/* reach PhotoPrism, while the
post-login /library/browse target still bounces back to the SvelteKit
SPA.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mulimage 2.0 merged the PhotoPrism + Go sidecar + SvelteKit architecture
into main and it now runs on LXC 120 (192.168.8.136). photos.hubris.network
moves from the legacy "reverse_proxy :3000" passthrough to the same
path-matchers pattern photos-new used: /api/v1/* + /static/* + /share/*
→ PhotoPrism (:2342), /api/sidecar/* → sidecar (:8000), catch-all →
nginx-served SvelteKit static bundle (:3000, was Vite dev in M0).
photos-new.hubris.network is removed entirely — LXC 127 is being
decommissioned in the same cutover.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Proxies to LXC 105:9810 (homelab-mcp SSE) and :9820 (secrets-issuance).
No SSO — both are agent-facing; auth happens at the service layer
(source-IP gating for issuance, mesh+LAN gating for both).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
