dtoro
25c67a79c6
Pushed dtoro/caddy-conf@c195142: oikos.hubris.network -> 192.168.8.205:8091, Authentik-gated (matches paperless.hubris.network's live pattern — confirmed exact snippet syntax against the real Caddyfile rather than trusting the paraphrase in the original README, which turned out to have the wrong forward_auth target: the live snippet points at 127.0.0.1:8099 on Caddy's own LXC, not 192.168.8.6:9000 as containers/106-auth-outpost.md's older text suggested). Reload verified clean — an unrelated existing route stayed healthy through it. Found and fixed a real deploy-blocking bug in the process: oikos-console.service bound 127.0.0.1 only, but Caddy runs on a different host (121) and can only reach apps (105) over the LAN — the console would have been completely unreachable once deployed. Now binds 0.0.0.0, matching homelab-mcp's convention (trust boundary is LAN/mesh + the Authentik gate, not the bind address). Encountered and deliberately left alone: a pre-existing local clone at /tmp/caddy-conf with an unpushed commit + uncommitted diff about jellyfin's auth gating, from before this clone fell 12 commits behind origin. That work turned out to be superseded (origin already reached the same conclusion — SSO plugin handles jellyfin auth, no forward-auth gate — via a different, already-merged path). Didn't touch it; used a fresh clone instead to avoid any risk of losing or corrupting that state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
1.1 KiB
Desktop File
28 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Oikos Console v0 (read-mostly web UI)
|
|
After=network-online.target homelab-context-sync.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=/opt/oikos-console
|
|
Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context
|
|
ExecStart=/opt/oikos-console/.venv/bin/uvicorn oikos.console.app:app --host 0.0.0.0 --port 8091
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Caddy runs on a DIFFERENT host (LXC 121) and reaches this over the LAN
|
|
# at 192.168.8.205:8091 (dtoro/caddy-conf's oikos.hubris.network block) —
|
|
# binding loopback-only would make this unreachable from Caddy entirely.
|
|
# Same bind convention as homelab-mcp (0.0.0.0, trust boundary enforced
|
|
# by LAN/mesh + the Authentik forward-auth gate in front, not by bind
|
|
# address). No public exposure: only reachable via LAN/mesh.
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
ReadOnlyPaths=/opt/homelab-context /opt/oikos-console
|
|
ReadWritePaths=/opt/homelab-context/signals /opt/homelab-context/approvals /opt/homelab-context/ledger /opt/homelab-context/oikos
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|