heather: add Kaneo with PostgreSQL

hosts/heather/arion-compose.nix

@@ -75,6 +75,12 @@ let
             description: No-code database
             server: heather
             container: teable
+        - Kaneo:
+            icon: kanban.png
+            href: https://kaneo.iscg.dev
+            description: Project management
+            server: heather
+            container: kaneo
   '';
 
   homepageSettingsYaml = pkgs.writeText "homepage-settings.yaml" ''
@@ -134,6 +140,8 @@ in
     teable-db = {};
     teable-redis = {};
     teable-assets = {};
+    # Kaneo PostgreSQL data
+    kaneo-db = {};
     # jitsi-стек (minimal, per official docker-compose.yml)
     jitsi-web-config = {};
     jitsi-prosody-config = {};
@@ -267,6 +275,34 @@ in
       service.volumes = [ "teable-redis:/data" ];
     };
 
+    # === Kaneo (kaneo.iscg.dev) ===
+    # Unified web + API image. PostgreSQL data is kept in a named volume;
+    # secrets live outside the Nix store in /var/lib/kaneo-secrets/kaneo.env.
+    kaneo = {
+      service.image = "ghcr.io/usekaneo/kaneo:2.12.1";
+      service.container_name = "kaneo";
+      service.restart = "unless-stopped";
+      service.ports = [ "127.0.0.1:3003:5173" ];
+      service.env_file = [ "/var/lib/kaneo-secrets/kaneo.env" ];
+      service.depends_on = [ "kaneo-db" ];
+      service.environment = {
+        KANEO_CLIENT_URL = "https://kaneo.iscg.dev";
+        KANEO_API_URL = "https://kaneo.iscg.dev/api";
+        CORS_ORIGINS = "https://kaneo.iscg.dev";
+        POSTGRES_HOST = "kaneo-db";
+        POSTGRES_PORT = "5432";
+        POSTGRES_DB = "kaneo";
+        POSTGRES_USER = "kaneo";
+      };
+    };
+    kaneo-db = {
+      service.image = "postgres:16-alpine";
+      service.container_name = "kaneo-db";
+      service.restart = "unless-stopped";
+      service.env_file = [ "/var/lib/kaneo-secrets/kaneo.env" ];
+      service.volumes = [ "kaneo-db:/var/lib/postgresql/data" ];
+    };
+
     # === Jitsi Meet (jitsi.iscg.dev) ===
     # Installed from scratch 2026-07-13 per official docs:
     #   https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker

hosts/heather/caddy.nix

@@ -104,6 +104,11 @@ Allow: /" 200
         reverse_proxy 127.0.0.1:2345
       '';
 
+      # Kaneo
+      "kaneo.iscg.dev".extraConfig = ''
+        reverse_proxy 127.0.0.1:3003
+      '';
+
       # Silverbullet
       "note.iscg.dev".extraConfig = ''
         reverse_proxy 127.0.0.1:3001