Harden Heather: retire remote agents and proxy, disable Jupyter, sandbox Matrix admin

hosts/heather/arion-compose.nix

@@ -29,8 +29,6 @@ let
             icon: forgejo.png
             href: https://git.iscg.dev
             description: Git forge (ssh :2222)
-            server: heather
-            container: forgejo
         - Syncthing:
             icon: syncthing.png
             href: https://sync.iscg.dev
@@ -44,33 +42,23 @@ let
             icon: matrix.png
             href: https://iscg.dev
             description: Matrix homeserver (iscg.dev)
-            server: heather
-            container: tuwunel
         - Cinny:
             icon: cinny.png
             href: https://chat.iscg.dev
             description: Matrix web client
-            server: heather
-            container: cinny
         - Jitsi Meet:
             icon: jitsi-meet.png
             href: https://jitsi.iscg.dev
             description: Video conferencing
-            server: heather
-            container: jitsi-web
     - Productivity:
         - Silverbullet:
             icon: silverbullet.png
             href: https://note.iscg.dev
             description: Notes wiki (herbarium)
-            server: heather
-            container: silverbullet
         - Teable:
             icon: /images/teable.png
             href: https://teable.iscg.dev
             description: No-code database
-            server: heather
-            container: teable
   '';
 
   homepageSettingsYaml = pkgs.writeText "homepage-settings.yaml" ''
@@ -86,8 +74,7 @@ let
       searchDescriptions: true
       hideInternetSearch: true
     hideVersion: true
-    # Live container status: green dot for healthy containers (docker-socket-proxy).
-    statusStyle: dot
+    # Static navigation only: no Docker API integration.
     # Background photo (mounted ro at /app/public/images/ from /var/lib/homepage-images).
     # cardBlur = frosted-glass / matte semi-transparent service & bookmark cards.
     # NB: cardBlur incompatible with background blur/saturate/brightness filters,
@@ -105,14 +92,8 @@ let
               href: https://git.iscg.dev/mikl/nix-config
   '';
 
-  # Docker integration: live container status (green dot / UP) per service.
-  # docker-socket-proxy exposes read-only /containers/json. homepage talks to it
-  # over the compose network (service name `dockerproxy`), no root on docker.sock.
-  homepageDockerYaml = pkgs.writeText "homepage-docker.yaml" ''
-    heather:
-      host: dockerproxy
-      port: 2375
-  '';
+  # Explicitly empty to avoid stale/default Docker integration configuration.
+  homepageDockerYaml = pkgs.writeText "homepage-docker.yaml" "{}\n";
 
 in
 {
@@ -195,26 +176,6 @@ in
       service.ports = [ "127.0.0.1:8080:80" ];
     };
 
-    # === Xray (VLESS + Reality, :8443) ===
-    # Прокси-сервер для обхода блокировок. Не относится к iscg.dev-сервисам:
-    # НЕ за Caddy, публичный порт 8443 напрямую. Reality маскируется под
-    # www.microsoft.com (чужой TLS, своего домена/cert не нужно).
-    # Конфиг с UUID + Reality privateKey в /var/lib/xray-secrets/config.json
-    # (вне git, root:docker 0640). Клиент: v2RayTun / v2rayN / etc.
-    # Секреты в pass iscg.dev/xray/{uuid,reality-private-key,reality-public-key}.
-    xray = {
-      service.image = "ghcr.io/xtls/xray-core:latest";
-      service.container_name = "xray";
-      service.restart = "unless-stopped";
-      # Образ по умолчанию читает -confdir /usr/local/etc/xray/ (split-конфиги).
-      # Переопределяем на единый config.json с VLESS+Reality.
-      service.command = [ "-config" "/etc/xray/config.json" ];
-      service.volumes = [
-        "/var/lib/xray-secrets/config.json:/etc/xray/config.json:ro"
-      ];
-      service.ports = [ "8443:8443" ];
-    };
-
     # === Teable (teable.iscg.dev) ===
     # Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12):
     #   - postgres восстановлен из pg_dump (18M, consistent, без остановки источника)
@@ -420,26 +381,6 @@ in
       };
     };
 
-    # === Docker socket proxy (read-only, for homepage live container status) ===
-    # tecnativa/docker-socket-proxy: whitelisted read-only subset of Docker API.
-    # CONTAINERS=1 → only /containers/json + /containers/{id}/json. POST=0 →
-    # no mutations. homepage connects over compose network (host: dockerproxy).
-    # Avoids mounting docker.sock directly into homepage (which would need root).
-    dockerproxy = {
-      service.image = "ghcr.io/tecnativa/docker-socket-proxy:latest";
-      service.container_name = "dockerproxy";
-      service.restart = "unless-stopped";
-      service.volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock:ro"
-      ];
-      service.environment = {
-        CONTAINERS = "1";
-        POST = "0";
-        SERVICES = "1";
-        TASKS = "1";
-      };
-    };
-
     # === Homepage (home.iscg.dev) — dashboard со всеми сервисами ===
     # gethomepage/homepage: статичный список ссылок на все сервисы heather.
     # Конфиги (services/settings/bookmarks.yaml) генерятся через pkgs.writeText