Update the photos.hubris.network block to match the current stack
(PhotoPrism API + Go sidecar + SvelteKit). Add prism.hubris.network
as a dedicated PhotoPrism vhost for the Prismatic mobile client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Domain-level proxy providers (Paperless, qBit) need an external_host that
routes to the LAN outpost (192.168.8.6), not auth.hubris.network (now the VPS
core). New site sso.hubris.network -> reverse_proxy 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Forward-auth now validates against the VPS Authentik core via a dedicated
LAN outpost (auth-outpost LXC 106), not LXC 124's frozen embedded outpost.
Resolves the post-migration split-brain. 192.168.8.180:9000 -> 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Earlier commits (e535f93 + a52cf68) proxied /library/login through to
PhotoPrism to fix what I thought was the OIDC initiation path. Wrong:
the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login
(already routed via @pp). The /library/login URL is what PhotoPrism's
UI uses POST-OIDC for the localStorage handoff back to the SPA — it
MUST bounce to / via the caddy redir, otherwise the SPA never picks
up the session and the user lands in PhotoPrism's own UI.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Without an explicit route{} block, caddy auto-hoists `redir` ahead of
`reverse_proxy`. That meant /library/* still redirected to / even
though I'd placed an @pp_login reverse_proxy above the redirs in the
file. Wrap the whole site in route{} so directives run in source order
and the more-specific /library/login matcher wins before the broader
/library/* redir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The /library/* catch-all redir bounced /library/login (PhotoPrism's
OIDC login surface) back to / before the user could click "Sign in
with Authentik". Add a specific @pp_login matcher above the redir
so /library/login + /library/login/* reach PhotoPrism, while the
post-login /library/browse target still bounces back to the SvelteKit
SPA.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mulimage 2.0 merged the PhotoPrism + Go sidecar + SvelteKit architecture
into main and it now runs on LXC 120 (192.168.8.136). photos.hubris.network
moves from the legacy "reverse_proxy :3000" passthrough to the same
path-matchers pattern photos-new used: /api/v1/* + /static/* + /share/*
→ PhotoPrism (:2342), /api/sidecar/* → sidecar (:8000), catch-all →
nginx-served SvelteKit static bundle (:3000, was Vite dev in M0).
photos-new.hubris.network is removed entirely — LXC 127 is being
decommissioned in the same cutover.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Proxies to LXC 105:9810 (homelab-mcp SSE) and :9820 (secrets-issuance).
No SSO — both are agent-facing; auth happens at the service layer
(source-IP gating for issuance, mesh+LAN gating for both).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reverse-proxies the new ZimaOS VM through the standard pattern (TLS via
IONOS DNS-01, plain reverse_proxy to backend). Cert issued by Lets
Encrypt on first request.
iOS Seafile Pro 4.0.2 negotiates resumable uploads via Upload-Draft-Interop-Version: 6, but Seafile-fileserver does not understand the protocol and never returns the expected interim response; the iOS client then cancels the HTTP/2 stream after ~60s and the upload (or library-create POST) appears to fail. Strip the negotiation headers so the client falls back to normal multipart upload, and bump upstream timeouts for large transfers.
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.
Leaves /p/* (share URLs), /static/*, /healthz public.
mule-image commit e8e1adc wires native OIDC against Authentik
(/api/v1/auth/oidc/login). Users land on mulita login and click
Sign in with Authentik; outpost not involved.
git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.
deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
