From 483454bf17a78ebdd3e825600975f0fb781ff479 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Sun, 12 Jul 2026 18:05:22 +0300
Subject: [PATCH] heather: rotate sync.iscg.dev basicauth password
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Старый хеш был скопирован с iscg-dev, пароль неизвестен. Новый пароль
в mindful-стиле. Сгенерирован через caddy hash-password (bcrypt cost 14).
---
 hosts/heather/caddy.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix
index c706481..9446722 100644
--- a/hosts/heather/caddy.nix
+++ b/hosts/heather/caddy.nix
@@ -15,11 +15,13 @@
 
 let
   # caddy/basic-auth под паролем. hash сгенерить:
-  #   caddy hash-password
-  # Пока заглушка — syncthing GUI имеет свой пароль + Caddy basicauth сверху.
+  #   caddy hash-password --plaintext '<password>'
+  # (на heather: nix-shell -p caddy --run 'caddy hash-password ...')
+  # Защищает syncthing GUI снаружи (GUI слушает только 127.0.0.1:8384,
+  # Caddy проксирует sync.iscg.dev + basicauth).
   syncBasicAuth = ''
     basicauth {
-      mikl $2a$14$bQ5MVsSFUuIJjHETVXzISOTy5SpLxRUlH6krxpzLH1.E0imi37Zb.
+      mikl $2a$14$ozHN9/aa4VhPX43NN8MKdODKvOoJ5MBpOUFhzkxwvb58ZI5b6eqEK
     }
   '';