Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
iOS Seafile Pro 4.0.2 negotiates resumable uploads via Upload-Draft-Interop-Version: 6, but Seafile-fileserver does not understand the protocol and never returns the expected interim response; the iOS client then cancels the HTTP/2 stream after ~60s and the upload (or library-create POST) appears to fail. Strip the negotiation headers so the client falls back to normal multipart upload, and bump upstream timeouts for large transfers.
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.
Leaves /p/* (share URLs), /static/*, /healthz public.
mule-image commit e8e1adc wires native OIDC against Authentik
(/api/v1/auth/oidc/login). Users land on mulita login and click
Sign in with Authentik; outpost not involved.
git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.
deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
Adds handle_path /_plantuml/* in git.hubris.network that rewrites to
/plantuml{uri} and proxies to 192.168.8.205:8079 (plantuml-server
docker container on LXC 105). Used by gitea footer.tmpl to render
PlantUML markdown code blocks without hitting the public demo server.
