Syncthing отдаёт 403 'Host check error' когда Host header не совпадает с адресом прослушивания (127.0.0.1:8384) — это DNS rebinding protection. Caddy подменяет Host на бэкенде через header_up Host 127.0.0.1:8384.
Старый хеш был скопирован с iscg-dev, пароль неизвестен. Новый пароль в mindful-стиле. Сгенерирован через caddy hash-password (bcrypt cost 14).
- remove k3s.nix (1.3GB overhead unjustified for single-node) - add docker.nix (docker + arion CLI, mikl in docker group) - add caddy.nix (edge proxy, TLS via ACME staging, host-based routing) - add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing) - add arion-compose.nix (forgejo first, others stubbed as TODO) - add arion flake input + nixos module - default.nix: wire up arion project as systemd service (serviceName=heather) Architecture: Caddy (host) terminates TLS, routes to host services (syncthing) and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except silverbullet (bind /srv/syncthing/herbarium).
