heather: add homepage dashboard (home.iscg.dev)

gethomepage/homepage container with all heather services listed:
forgejo, syncthing, tuwunel-admin, tuwunel, cinny, jitsi,
silverbullet, teable. Configs baked via pkgs.writeText (ro bind mount).
Caddy vhost home.iscg.dev -> 127.0.0.1:3002.

hosts/heather/arion-compose.nix

@@ -19,6 +19,70 @@
 
 { pkgs, ... }:
 
+let
+  # Homepage (gethomepage) dashboard configs — baked via pkgs.writeText,
+  # bind-mounted ro в контейнер. Полностью декларативно, версионировано в git.
+  # Документация: https://gethomepage.dev/configs/
+  homepageServicesYaml = pkgs.writeText "homepage-services.yaml" ''
+    - Infrastructure:
+        - Forgejo:
+            icon: forgejo.png
+            href: https://git.iscg.dev
+            description: Git forge (ssh :2222)
+        - Syncthing:
+            icon: syncthing.png
+            href: https://sync.iscg.dev
+            description: File sync GUI
+        - tuwunel-admin:
+            icon: matrix.png
+            href: https://admin.iscg.dev
+            description: Matrix admin room UI
+    - Communication:
+        - Tuwunel:
+            icon: matrix.png
+            href: https://iscg.dev
+            description: Matrix homeserver (iscg.dev)
+        - Cinny:
+            icon: cinny.png
+            href: https://chat.iscg.dev
+            description: Matrix web client
+        - Jitsi Meet:
+            icon: jitsi.png
+            href: https://jitsi.iscg.dev
+            description: Video conferencing
+    - Productivity:
+        - Silverbullet:
+            icon: silverbullet.png
+            href: https://note.iscg.dev
+            description: Notes wiki (herbarium)
+        - Teable:
+            icon: teable.png
+            href: https://teable.iscg.dev
+            description: No-code database
+  '';
+
+  homepageSettingsYaml = pkgs.writeText "homepage-settings.yaml" ''
+    title: iscg.dev
+    theme: dark
+    color: slate
+    headerStyle: boxed
+    layout:
+      Infrastructure:
+      Communication:
+      Productivity:
+    quicklaunch:
+      searchDescriptions: true
+      hideInternetSearch: true
+    hideVersion: true
+  '';
+
+  homepageBookmarksYaml = pkgs.writeText "homepage-bookmarks.yaml" ''
+    - Forge:
+        - nix-config:
+            - https://git.iscg.dev/mikl/nix-config
+  '';
+
+in
 {
   # Обязательное имя проекта (COMPOSE_PROJECT_NAME). Объекты префиксуются им:
   # heather_forgejo-data и т.д.
@@ -99,6 +163,23 @@
       service.ports = [ "127.0.0.1:8080:80" ];
     };
 
+    # === Xray (VLESS + Reality, :8443) ===
+    # Прокси-сервер для обхода блокировок. Не относится к iscg.dev-сервисам:
+    # НЕ за Caddy, публичный порт 8443 напрямую. Reality маскируется под
+    # www.microsoft.com (чужой TLS, своего домена/cert не нужно).
+    # Конфиг с UUID + Reality privateKey в /var/lib/xray-secrets/config.json
+    # (вне git, root:docker 0640). Клиент: v2RayTun / v2rayN / etc.
+    # Секреты в pass iscg.dev/xray/{uuid,reality-private-key,reality-public-key}.
+    xray = {
+      service.image = "ghcr.io/xtls/xray-core:latest";
+      service.container_name = "xray";
+      service.restart = "unless-stopped";
+      service.volumes = [
+        "/var/lib/xray-secrets/config.json:/etc/xray/config.json:ro"
+      ];
+      service.ports = [ "8443:8443" ];
+    };
+
     # === Teable (teable.iscg.dev) ===
     # Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12):
     #   - postgres восстановлен из pg_dump (18M, consistent, без остановки источника)
@@ -296,6 +377,27 @@
       };
     };
 
+    # === Homepage (home.iscg.dev) — dashboard со всеми сервисами ===
+    # gethomepage/homepage: статичный список ссылок на все сервисы heather.
+    # Конфиги (services/settings/bookmarks.yaml) генерятся через pkgs.writeText
+    # в nix store и bind-mount ro. Без docker socket — без живых статусов,
+    # просто навигация. Образ :latest (GHCR для gethomepage доступен, в отличие
+    # от jitsi). BASE_URL = публичный домен.
+    homepage = {
+      service.image = "ghcr.io/gethomepage/homepage:latest";
+      service.container_name = "homepage";
+      service.restart = "unless-stopped";
+      service.ports = [ "127.0.0.1:3002:3000" ];
+      service.volumes = [
+        "${homepageServicesYaml}:/app/config/services.yaml:ro"
+        "${homepageSettingsYaml}:/app/config/settings.yaml:ro"
+        "${homepageBookmarksYaml}:/app/config/bookmarks.yaml:ro"
+      ];
+      service.environment = {
+        BASE_URL = "https://home.iscg.dev";
+      };
+    };
+
     # === Backup sidecar (последним) ===
     # offen/docker-volume-backup: nightly tar.gz всех named volumes.
     # Монтирует volumes read-only, шлёт в /var/backups (или S3).

hosts/heather/caddy.nix

@@ -88,6 +88,11 @@ in {
       "note.iscg.dev".extraConfig = ''
         reverse_proxy 127.0.0.1:3001
       '';
+
+      # Homepage (dashboard со всеми сервисами heather)
+      "home.iscg.dev".extraConfig = ''
+        reverse_proxy 127.0.0.1:3002
+      '';
     };
   };
 }