Harden Heather: retire remote agents and proxy, disable Jupyter, sandbox Matrix admin

hosts/heather/default.nix

@@ -20,9 +20,9 @@
     ./caddy.nix           # edge proxy, TLS, роутинг по доменам
     ./syncthing.nix       # sync + relay
     ./tuwunel-admin.nix   # matrix admin web UI (systemd, статический бинарник)
-    ./paseo.nix           # paseo daemon (web UI для CLI-агентов, systemd + npm global)
     ./nick.nix            # Nick timer prototype (systemd, localhost:8787)
-    ./jupyter.nix         # JupyterLab (systemd, localhost:8890, лимиты)
+    # Jupyter is intentionally disabled until it has a separate service identity.
+    # Keep its venv, notebooks and external credentials untouched.
     ./astrnet.nix        # AstrNet (Sol): two WireGuard legs, FRR/BGP, ingress guard
     ./minecraft-api.nix  # mesh-only typed Minecraft API, isolated DynamicUser
   ];
@@ -72,6 +72,18 @@
   # explicitly with `arion --prebuilt-file <active-unit-compose> up -d --no-deps SERVICE`.
   systemd.services.heather.restartIfChanged = false;
 
+  # The public dashboard is navigation only, never a Docker administration client.
+  assertions = [
+    {
+      assertion = let
+        services = config.virtualisation.arion.projects.heather.settings.services;
+      in !(services ? dockerproxy) && lib.all
+        (service: lib.all (mount: !(lib.hasInfix "docker.sock" mount)) service.service.volumes)
+        (lib.attrValues services);
+      message = "Heather web stack must not expose Docker socket access or a dockerproxy service.";
+    }
+  ];
+
   networking = {
     hostName = "heather";
     # Firewall выключен в ./image.nix (полагаемся на YC Security Groups).
@@ -85,7 +97,6 @@
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
       3478    # coturn TURN (tcp+udp)
-      8443    # xray VLESS+Reality (публичный прокси)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)