Without an explicit route{} block, caddy auto-hoists `redir` ahead of
`reverse_proxy`. That meant /library/* still redirected to / even
though I'd placed an @pp_login reverse_proxy above the redirs in the
file. Wrap the whole site in route{} so directives run in source order
and the more-specific /library/login matcher wins before the broader
/library/* redir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The /library/* catch-all redir bounced /library/login (PhotoPrism's
OIDC login surface) back to / before the user could click "Sign in
with Authentik". Add a specific @pp_login matcher above the redir
so /library/login + /library/login/* reach PhotoPrism, while the
post-login /library/browse target still bounces back to the SvelteKit
SPA.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mulimage 2.0 merged the PhotoPrism + Go sidecar + SvelteKit architecture
into main and it now runs on LXC 120 (192.168.8.136). photos.hubris.network
moves from the legacy "reverse_proxy :3000" passthrough to the same
path-matchers pattern photos-new used: /api/v1/* + /static/* + /share/*
→ PhotoPrism (:2342), /api/sidecar/* → sidecar (:8000), catch-all →
nginx-served SvelteKit static bundle (:3000, was Vite dev in M0).
photos-new.hubris.network is removed entirely — LXC 127 is being
decommissioned in the same cutover.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Proxies to LXC 105:9810 (homelab-mcp SSE) and :9820 (secrets-issuance).
No SSO — both are agent-facing; auth happens at the service layer
(source-IP gating for issuance, mesh+LAN gating for both).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
iOS Seafile Pro 4.0.2 negotiates resumable uploads via Upload-Draft-Interop-Version: 6, but Seafile-fileserver does not understand the protocol and never returns the expected interim response; the iOS client then cancels the HTTP/2 stream after ~60s and the upload (or library-create POST) appears to fail. Strip the negotiation headers so the client falls back to normal multipart upload, and bump upstream timeouts for large transfers.
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.
Leaves /p/* (share URLs), /static/*, /healthz public.
mule-image commit e8e1adc wires native OIDC against Authentik
(/api/v1/auth/oidc/login). Users land on mulita login and click
Sign in with Authentik; outpost not involved.
git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.
deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
Adds handle_path /_plantuml/* in git.hubris.network that rewrites to
/plantuml{uri} and proxies to 192.168.8.205:8079 (plantuml-server
docker container on LXC 105). Used by gitea footer.tmpl to render
PlantUML markdown code blocks without hitting the public demo server.
