mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden Heather: retire remote agents and proxy, disable Jupyter, sandbox Matrix admin

Browse source
This commit is contained in:
heather 2026-10-25 22:56:01 +00:00
commit 6e2ba02b9a
5 changed files with 53 additions and 149 deletions
Download patch file Download diff file Expand all files Collapse all files

13
hosts/heather/caddy.nix
View file

@ -114,17 +114,16 @@ Allow: /" 200
encode zstd gzip
'';
# paseo daemon endpoint для desktop/mobile-клиентов.
# Basic Auth здесь намеренно нет: мобильный клиент Paseo его не умеет.
# Доступ защищён встроенным PASEO_PASSWORD самого демона.
# Retired control plane: keep TLS but never proxy to a daemon.
"paseo.iscg.dev".extraConfig = ''
reverse_proxy 127.0.0.1:6767
header Cache-Control "no-store"
respond "Paseo has been retired" 410
'';
# JupyterLab: native login form (пароль хранится как bcrypt-хеш
# в /var/lib/jupyter-secrets/jupyter.env), наружу только HTTPS.
# Disabled pending isolation from the administrative account.
"jupyter.iscg.dev".extraConfig = ''
reverse_proxy 127.0.0.1:8890
header Cache-Control "no-store"
respond "Jupyter is temporarily disabled" 503
'';
# Nick timer prototype. Public timer pages; creation has no auth for now.