Mulimage 2.0 merged the PhotoPrism + Go sidecar + SvelteKit architecture
into main and it now runs on LXC 120 (192.168.8.136). photos.hubris.network
moves from the legacy "reverse_proxy :3000" passthrough to the same
path-matchers pattern photos-new used: /api/v1/* + /static/* + /share/*
→ PhotoPrism (:2342), /api/sidecar/* → sidecar (:8000), catch-all →
nginx-served SvelteKit static bundle (:3000, was Vite dev in M0).
photos-new.hubris.network is removed entirely — LXC 127 is being
decommissioned in the same cutover.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Proxies to LXC 105:9810 (homelab-mcp SSE) and :9820 (secrets-issuance).
No SSO — both are agent-facing; auth happens at the service layer
(source-IP gating for issuance, mesh+LAN gating for both).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
iOS Seafile Pro 4.0.2 negotiates resumable uploads via Upload-Draft-Interop-Version: 6, but Seafile-fileserver does not understand the protocol and never returns the expected interim response; the iOS client then cancels the HTTP/2 stream after ~60s and the upload (or library-create POST) appears to fail. Strip the negotiation headers so the client falls back to normal multipart upload, and bump upstream timeouts for large transfers.
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.
Leaves /p/* (share URLs), /static/*, /healthz public.
mule-image commit e8e1adc wires native OIDC against Authentik
(/api/v1/auth/oidc/login). Users land on mulita login and click
Sign in with Authentik; outpost not involved.
Adds handle_path /_plantuml/* in git.hubris.network that rewrites to
/plantuml{uri} and proxies to 192.168.8.205:8079 (plantuml-server
docker container on LXC 105). Used by gitea footer.tmpl to render
PlantUML markdown code blocks without hitting the public demo server.
