Bootstrap Homelab-Docs wiki

Initial documentation of the hubris Proxmox homelab as a cross-linked
markdown wiki. Per-node pages, cross-cutting infrastructure pages, an
investigation log, and an operations cheatsheet. Each node and topic
ends with a Changelog section so changes can be tracked in-place going
forward.

Refreshed against live state on 2026-04-28 — 14 active LXCs (109
syncthing currently stopped) + 1 VM (108 haos). Reflects post-A/B-test
state of the 2026-04-21 hubris crash-loop investigation.

containers/121-caddy.md

@@ -0,0 +1,81 @@
+# 121 — `caddy`
+
+The reverse proxy. Terminates TLS for every `*.hubris.network` hostname on the LAN/mesh and forwards to the right backend.
+
+## At a glance
+- **Hostname:** `caddy`
+- **IP:** `192.168.8.175`
+- **Privilege:** **unprivileged**
+- **Resources:** 1 core / 512 MiB RAM / 6 GiB rootfs
+- **Mounts:** none from `/mnt/library`
+- **Config:** `/etc/caddy/Caddyfile` is a [git checkout of `dtoro/caddy-conf`](#auto-deploy)
+- **Cert source:** Let's Encrypt **DNS-01** via IONOS API (`IONOS_AUTH_API_TOKEN`).
+
+## Sites currently served (live as of 2026-04-28)
+
+- `artifacto.hubris.network` → [apps (105)](105-apps.md) `:3100`
+- `auth.hubris.network` → [authentik (124)](124-authentik.md) `:9000`
+- `blog.hubris.network` → [apps (105)](105-apps.md) `:8080`
+- `books.hubris.network` → [apps (105)](105-apps.md) `:6060`
+- `cloud.hubris.network` → [nextcloud (114)](114-nextcloud.md) `:443`
+- `docker.hubris.network` → [apps (105)](105-apps.md) `:9443`
+- `git.hubris.network` → [gitea (104)](104-gitea.md) `:3000` (+ `handle_path /_plantuml/*` → apps `:8079`)
+- `home.hubris.network` → [haos VM (108)](../vms/108-haos.md) `192.168.8.101:8123`
+- `jellyseerr.hubris.network` → [arriman (122)](122-arriman.md) `:5056`
+- `matrix.hubris.network` → [elementsynapse (118)](118-elementsynapse.md) `:8008`
+- `media.hubris.network` → [jellyfin (101)](101-jellyfin.md) `:8096`
+- `paperless.hubris.network` → [paperless (103)](103-paperless.md) `:8000`
+- `photos.hubris.network` → [mule-images (120)](120-mule-images.md) `:3000`
+- `proxmox.hubris.network` → [hubris host](../hosts/hubris.md) `:8006`
+- `qbit.hubris.network` → [arriman (122)](122-arriman.md) `:8080`
+- `sab.hubris.network` → [arriman (122)](122-arriman.md) `:8081`
+
+> **Reminder:** Caddy alone isn't enough to make a new subdomain reachable on the LAN. Each one needs an entry in [DNS split-horizon](../infrastructure/dns.md) too.
+
+## Snippet: `(authentik)` forward-auth
+
+A snippet at the top of the Caddyfile (used as `import authentik` in any site block) wires forward-auth to the embedded Authentik outpost. It points at `http://192.168.8.180:9000` directly (NOT `https://auth.hubris.network`) to avoid Caddy-to-self round-tripping that strips `X-Forwarded-Host`. The forward-auth block must explicitly set `header_up X-Forwarded-Host {host}`. See [Authentik](124-authentik.md#forward-auth-domain-level-setup).
+
+For apps with mobile clients, `/api/*` (or equivalent) bypasses forward-auth — see the per-app gotchas in [Authentik](124-authentik.md).
+
+## Caddy environment
+
+Untracked secrets in `/etc/caddy/caddy.env`:
+- `IONOS_AUTH_API_TOKEN` — DNS-01 ACME
+- `ARTIFACTO_GATEWAY_SECRET` — must match `SSO_GATEWAY_SECRET` on [apps (105)](105-apps.md). Rotate together.
+
+## Auto-deploy
+
+Push to `dtoro/caddy-conf` master → gitea webhook → `http://192.168.8.175:9797/deploy` → `caddy-deploy-webhook.service` validates HMAC against `/etc/caddy-deploy/secret` → runs `/etc/caddy/scripts/deploy.sh`:
+1. `git pull`
+2. `caddy validate`
+3. `systemctl reload caddy`
+
+Gitea webhook id 2 on `dtoro/caddy-conf`. Receiver, deploy script, install scripts, systemd unit all live in the repo under `scripts/`. The unit has `ReadWritePaths=/etc/caddy` — load-bearing (`ProtectSystem=full` would otherwise block `git pull`). Git credentials for the root-run service are at `/etc/caddy-deploy/git-credentials` (mode 600).
+
+> **Systemd unit changes inside the repo do NOT auto-reinstall** — you have to re-run `scripts/webhook/install.sh` manually after editing the unit.
+
+## Related
+- [DNS split-horizon](../infrastructure/dns.md) — must add entry for every new subdomain
+- [Authentik (124)](124-authentik.md) — forward-auth + IdP
+- [Auto-deploy](../infrastructure/auto-deploy.md)
+- [Public ingress (VPS traefik)](../infrastructure/ingress.md) — mirrors Caddy's certs to the VPS for public exposure
+- [Gitea (104)](104-gitea.md) — webhook source
+- All container pages list their Caddy backend.
+
+## Changelog
+
+### 2026-04-28 — wiki entry created
+Initial documentation. 16 active sites at this date.
+
+### 2026-04-22 — Artifacto + Authentik gateway-secret pattern wired
+Caddy site `artifacto.hubris.network`: forward-auth on admin paths, `header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}`, public matchers `/p/*`, `/static/*`, `/healthz`. `caddy.env` extended with the gateway secret.
+
+### 2026-04-21 — `(authentik)` snippet added
+Top-of-file snippet used by every gated site. Targets `http://192.168.8.180:9000` directly to dodge hairpin TLS round-trip.
+
+### 2026-04-21 — three new sites added (jellyseerr, qbit, sab → 192.168.8.132)
+For the [arriman (122)](122-arriman.md) docker stack. Caddy + certs work; needed corresponding [DNS split-horizon](../infrastructure/dns.md) entries to be added to land cleanly.
+
+### 2026-04-20 — auto-deploy pipeline shipped
+Repo `dtoro/caddy-conf`. Webhook receiver at `:9797`, validate + reload on push to master.