ee8ce3f99f
heather: enable jitsi meet stack (jitsi.iscg.dev)
...
Стек: web + prosody + jicofo + jvb + coturn. Перенесено с jul11 (2026-07-12):
- config (web/prosody/jicofo/jvb) → named volumes heather_jitsi-{web,prosody,jicofo,jvb,transcripts}
- prosody user mikl.dat сохранён (internal auth)
- образ PIN: stable-11031 (как на jul11, НЕ :latest)
- пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
- env-файл /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
- coturn в host network (real client IPs), realm=turn.iscg.dev
- JVB 10000/udp публично (YC SG уже ANY ANY open)
- Caddy: WebSocket routes /xmpp-websocket, /colibri-ws (hop-by-hop upgrade)
- DISABLE_HTTPS=1 (Caddy терминирует TLS)
2026-07-12 21:56:37 +03:00
cc6ef61d0a
heather: pin teable to working image digest, revert port to 3000
...
:latest (release 2198, 2026-07-11) сломал роутинг: Next.js отдаёт 404
на / и /health, assets под /plugin/. Пиним digest из iscg-dev (март 2026)
где / → 307 → /space работает. Старый образ слушает 3000 (не 3002).
2026-07-12 20:46:53 +03:00
c079adba66
heather: teable listens on 3002, fix port mapping
2026-07-12 20:16:22 +03:00
3e3241683f
heather: enable teable stack (teable.iscg.dev)
...
app + postgres:15 + redis. Данные перенесены с iscg-dev (2026-07-12):
- postgres восстановлен из pg_dump (18M) с новым паролем
- .assets (3.2G, 4392 файлов) в named volume heather_teable-assets
- teable-data, redis пустые (наполнятся при старте)
Секреты (POSTGRES_PASSWORD, SECRET_KEY, PRISMA_DATABASE_URL) новые,
в pass iscg.dev/teable/. env-файл /var/lib/teable-secrets/teable.env
на heather (вне git, root:docker 0640).
2026-07-12 20:09:15 +03:00
260a6c64bf
heather: enable silverbullet (note.iscg.dev)
...
Bind mount /srv/syncthing/herbarium → /space. Данные перенесены с iscg-dev
(564K, 41 файл). Auth-файл .silverbullet.auth.json в составе данных.
SB_USER/SB_INDEX_PAGE из старого compose на iscg-dev.
2026-07-12 18:51:11 +03:00
ebf74814bf
heather: fix arion volumes declaration + syncthing configDir perms
...
- arion-compose: project.name (required) + docker-compose.volumes (correct
option, was docker-compose.raw.volumes which didn't exist)
- syncthing: tmpfiles for /var/lib/syncthing (configDir) owned by mikl,
fixes 'mkdir /var/lib/syncthing: permission denied' when running as non-default user
2026-07-12 12:39:26 +03:00
220d1f651c
heather: replace k3s with docker+arion+caddy+syncthing
...
- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)
Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).
2026-07-12 12:23:05 +03:00
