8709321ca3
heather: install jitsi meet from scratch (web/prosody/jicofo/jvb)
...
Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)
2026-07-12 22:42:36 +03:00
fd605c51ce
heather: remove jitsi stack (web/prosody/jicofo/jvb/coturn)
...
Fully remove jitsi from arion-compose.nix, caddy.nix, default.nix.
Will be reinstalled from scratch.
2026-07-12 22:35:03 +03:00
ee8ce3f99f
heather: enable jitsi meet stack (jitsi.iscg.dev)
...
Стек: web + prosody + jicofo + jvb + coturn. Перенесено с jul11 (2026-07-12):
- config (web/prosody/jicofo/jvb) → named volumes heather_jitsi-{web,prosody,jicofo,jvb,transcripts}
- prosody user mikl.dat сохранён (internal auth)
- образ PIN: stable-11031 (как на jul11, НЕ :latest)
- пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
- env-файл /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
- coturn в host network (real client IPs), realm=turn.iscg.dev
- JVB 10000/udp публично (YC SG уже ANY ANY open)
- Caddy: WebSocket routes /xmpp-websocket, /colibri-ws (hop-by-hop upgrade)
- DISABLE_HTTPS=1 (Caddy терминирует TLS)
2026-07-12 21:56:37 +03:00
e99b6e1c28
heather: fix syncthing host-check error behind Caddy reverse proxy
...
Syncthing отдаёт 403 'Host check error' когда Host header не совпадает с
адресом прослушивания (127.0.0.1:8384) — это DNS rebinding protection.
Caddy подменяет Host на бэкенде через header_up Host 127.0.0.1:8384.
2026-07-12 18:19:22 +03:00
483454bf17
heather: rotate sync.iscg.dev basicauth password
...
Старый хеш был скопирован с iscg-dev, пароль неизвестен. Новый пароль
в mindful-стиле. Сгенерирован через caddy hash-password (bcrypt cost 14).
2026-07-12 18:05:22 +03:00
4eb5a1e61c
heather: switch caddy to production ACME (DNS moved to heather)
2026-07-12 13:21:25 +03:00
220d1f651c
heather: replace k3s with docker+arion+caddy+syncthing
...
- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)
Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).
2026-07-12 12:23:05 +03:00
