Claudio
a3d7e6a61c
photos-new: bounce /library/* to / after OIDC
2026-05-17 22:03:35 +02:00
Claudio
e90f9078d8
Add photos-new.hubris.network -> LXC 127 (PhotoPrism M0 test)
2026-05-17 21:36:39 +02:00
Claudio
a219176c95
Add zimaos.hubris.network -> VM 100 (192.168.8.195)
...
Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
2026-05-14 13:29:26 +02:00
claudio
ba935abbfb
Add plato.hubris.network → LXC 126:8080
2026-05-13 01:14:44 +02:00
claudio
65507e68f7
Remove files.hubris.network (Seafile decommissioned)
2026-05-13 00:29:55 +02:00
Caddy on hubris
f0a8835d8c
Route /thumbnail/* on files.hubris.network to Seafile Pro thumbnail-server (LXC 125:8081)
2026-05-12 18:57:57 +02:00
Caddy on hubris
c1c161d1b8
Strip IETF resumable-upload headers for Seafile iOS app (LXC 125)
...
iOS Seafile Pro 4.0.2 negotiates resumable uploads via Upload-Draft-Interop-Version: 6, but Seafile-fileserver does not understand the protocol and never returns the expected interim response; the iOS client then cancels the HTTP/2 stream after ~60s and the upload (or library-create POST) appears to fail. Strip the negotiation headers so the client falls back to normal multipart upload, and bump upstream timeouts for large transfers.
2026-05-12 18:10:40 +02:00
Caddy on hubris
139f889c23
Add files.hubris.network for Seafile (LXC 125)
2026-05-12 12:21:29 +02:00
claudio
7e856d85a6
Gate artifacto admin with Authentik + forward gateway header
...
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.
Leaves /p/* (share URLs), /static/*, /healthz public.
2026-04-22 22:20:56 +02:00
root
a6b12a4e64
Revert photos.hubris.network forward-auth
...
mule-image commit e8e1adc wires native OIDC against Authentik
(/api/v1/auth/oidc/login). Users land on mulita login and click
Sign in with Authentik; outpost not involved.
2026-04-22 22:15:24 +02:00
root
8ed2631f6b
Gate photos.hubris.network behind Authentik forward-auth
...
Bypass /api/* for JWT/mobile clients (mulita uses Bearer tokens;
SPA login POSTs /api/v1/auth/login). Browser UI goes through the
embedded outpost.
2026-04-22 22:13:06 +02:00
claudio
31eb41a05a
Add artifacto.hubris.network → LXC 105:3100
2026-04-22 21:04:09 +02:00
claudio
8be7291059
Remove temp keys.hubris.network (bootstrap done)
2026-04-22 17:47:49 +02:00
claudio
55c7a8e8f2
TEMP: keys.hubris.network for netbird bootstrap
2026-04-22 16:24:11 +02:00
claudio
18343396aa
blog: drop forward-auth, WriteFreely has native OIDC
2026-04-22 14:20:00 +02:00
claudio
c6a3707363
blog: gate only admin/login paths with Authentik; leave public reading open
2026-04-22 14:17:57 +02:00
claudio
2663401d26
Gate blog.hubris.network with Authentik forward-auth
2026-04-22 14:10:22 +02:00
claudio
9a002648cc
Gate qbit.hubris.network with Authentik forward-auth, bypass /api/* for clients
2026-04-22 13:33:51 +02:00
claudio
8727399e84
Drop forward-auth on books.hubris.network — Booklore has native OIDC
2026-04-22 10:57:53 +02:00
claudio
2916449322
Gate books.hubris.network (Booklore) with Authentik forward-auth
2026-04-22 10:48:00 +02:00
claudio
f04a82f451
paperless: bypass Authentik forward-auth for /api/* so mobile apps (own token auth) can work
2026-04-22 10:12:53 +02:00
claudio
f2fd96e336
Forward-auth snippet final (dynamic X-Forwarded-Host, caddy fmt)
2026-04-22 01:05:31 +02:00
claudio
b2b6c86437
Explicitly set X-Forwarded-Host for forward_auth (Authentik needs it)
2026-04-22 01:02:35 +02:00
claudio
cb124a1cd2
Drop header_up Host from forward_auth so Authentik sees X-Forwarded-Host
2026-04-22 01:00:27 +02:00
claudio
a767cbf034
Gate paperless.hubris.network with Authentik forward-auth
2026-04-22 00:55:59 +02:00
claudio
ea4371089c
Add (authentik) forward-auth snippet for domain-level SSO
2026-04-22 00:45:30 +02:00
claudio
d74053bbd4
Add auth.hubris.network → Authentik on LXC 124:9000
2026-04-21 22:53:51 +02:00
Claudio
877d025ceb
Rename images.hubris.network → photos.hubris.network
2026-04-21 20:56:59 +02:00
Claudio
1b063b9cb4
Add images.hubris.network → mule-image frontend on mule-images:3000
2026-04-21 20:53:00 +02:00
dtoro
07a2d071d1
Add blog.hubris.network → WriteFreely on apps:8080
2026-04-21 16:16:55 +02:00
hubris-root
8ce7a82fd4
add jellyseerr, qbit, sab entries (arriman 192.168.8.132)
2026-04-21 13:17:25 +02:00
Claudio
24c66803e4
Proxy /_plantuml to self-hosted plantuml-server
...
Adds handle_path /_plantuml/* in git.hubris.network that rewrites to
/plantuml{uri} and proxies to 192.168.8.205:8079 (plantuml-server
docker container on LXC 105). Used by gitea footer.tmpl to render
PlantUML markdown code blocks without hitting the public demo server.
2026-04-20 17:04:03 +02:00
e5bc81b911
Remove unused blog
2026-04-20 16:31:39 +02:00
cef27b9a64
Add Booklore
2026-04-20 00:03:09 +02:00
c29194a17e
Add paperless
2026-04-19 22:59:01 +02:00
13d70c59b5
Add nextcloud
2026-04-19 22:32:16 +02:00
cf8f8d8966
Add Matrix
2026-04-19 22:17:15 +02:00
de45bfceeb
Add homeassitant
2026-04-19 21:48:05 +02:00
68ee03b2e8
Update proxmox
2026-04-19 21:35:37 +02:00
28a88fdb7f
Update proxmox
2026-04-19 21:33:48 +02:00
d9ddfd8679
Update proxmox to https
2026-04-19 21:22:29 +02:00
8d5e12b240
Add proxmox
2026-04-19 21:14:34 +02:00
root
39f0384ec9
initialize
2026-04-19 15:19:54 +02:00
