Agent host: SilverBullet serves the vault as its one space, behind Authelia

The operator chose single-space mode: the vault is mounted at /data, with
memory/ read-only over it, and there are no accounts or setup wizard;
Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so
an empty vault can't boot the wizard. SilverBullet's own data folder is
gone. check now fails if the wizard could be open. The README says how to
make memory/ writable for a while and back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/README.md

@@ -7,9 +7,9 @@ later (M6.1).
 
 ## What's here
 
-- `silverbullet/compose.yaml`: SilverBullet, its version pinned. It mounts the
-  vault, with the agents' `memory/` read-only, and its own data folder.
-  Nothing else of the host.
+- `silverbullet/compose.yaml`: SilverBullet, its version pinned, serving the
+  vault as its one space, with the agents' `memory/` read-only. Nothing else of
+  the host. It has no accounts: the operator logs in through Authelia.
 - `setup.sh`: makes the vault's folders, installs the stack under
   `/opt/stacks/silverbullet` and the firewall, and starts it. Safe to run again.
 - `nisse-firewall`: only the operator's Caddy may reach SilverBullet's port
@@ -17,8 +17,8 @@ later (M6.1).
 - `check.sh`: run on the host by `scripts/agent-host.sh check`; says "all
   checks passed" only once every check has run.
 - `caddy/nisse-memory.dongar.net.caddy`: the site for the operator's Caddy on
-  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, inside
-  garrett-hall.com only.
+  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate,
+  behind Authelia.
 
 ## The vault
 
@@ -41,12 +41,14 @@ scripts/agent-host.sh install   # copy this folder over and run setup.sh
 scripts/agent-host.sh check     # running, mounts, firewall
 ```
 
-Then:
+Then **the operator adds the Caddy site** from
+`caddy/nisse-memory.dongar.net.caddy`, behind Authelia, and reloads Caddy.
+There's no setup wizard: SilverBullet starts serving the vault at once.
 
-1. **The operator adds the Caddy site** from `caddy/nisse-memory.dongar.net.caddy`
-   and reloads Caddy.
-2. **The operator runs SilverBullet's setup wizard at once,** at
-   `https://nisse-memory.dongar.net`. Until it's done, whoever opens the page first
-   makes the administrator account.
-   - Account: the operator's, with a strong password.
-   - Space: folder `/vault`, address `nisse-memory.dongar.net`, path `/`.
+**Making `memory/` writable for a while** (for example, to upload material that
+will be sorted into the agents' folders): on the host, add
+`/opt/stacks/silverbullet/compose.override.yaml` that replaces the volumes with
+the vault alone (`volumes: !override [/srv/nisse/vault:/data]`), give `memory/`
+to uid 1000, and `docker compose up -d`. `check` fails while it's in place.
+To end it, delete the override and run `install` again, which gives `memory/`
+back to root.