From e287eea2d375b4cff74eed402433e5b8b8b8dbc1 Mon Sep 17 00:00:00 2001 From: Don Garrett Date: Mon, 19 Oct 2026 16:08:30 +0000 Subject: [PATCH] Agent host: the site is nisse-memory.dongar.net, inside garrett-hall.com The operator renamed the site from vault.dongar.net. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk --- deploy/agent-host/README.md | 11 ++++++----- ...dongar.net.caddy => nisse-memory.dongar.net.caddy} | 2 +- deploy/agent-host/setup.sh | 2 +- docs/Development-Plan.md | 6 +++--- tests/deploy/test_agent_host.py | 2 +- 5 files changed, 12 insertions(+), 11 deletions(-) rename deploy/agent-host/caddy/{vault.dongar.net.caddy => nisse-memory.dongar.net.caddy} (93%) diff --git a/deploy/agent-host/README.md b/deploy/agent-host/README.md index 6b8c9b3..af96fed 100644 --- a/deploy/agent-host/README.md +++ b/deploy/agent-host/README.md @@ -16,8 +16,9 @@ later (M6.1). (Docker's `DOCKER-USER` chain, re-applied whenever Docker starts). - `check.sh`: run on the host by `scripts/agent-host.sh check`; says "all checks passed" only once every check has run. -- `caddy/vault.dongar.net.caddy`: the site for the operator's Caddy on - `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, LAN only. +- `caddy/nisse-memory.dongar.net.caddy`: the site for the operator's Caddy on + `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, inside + garrett-hall.com only. ## The vault @@ -42,10 +43,10 @@ scripts/agent-host.sh check # running, mounts, firewall Then: -1. **The operator adds the Caddy site** from `caddy/vault.dongar.net.caddy` +1. **The operator adds the Caddy site** from `caddy/nisse-memory.dongar.net.caddy` and reloads Caddy. 2. **The operator runs SilverBullet's setup wizard at once,** at - `https://vault.dongar.net`. Until it's done, whoever opens the page first + `https://nisse-memory.dongar.net`. Until it's done, whoever opens the page first makes the administrator account. - Account: the operator's, with a strong password. - - Space: folder `/vault`, address `vault.dongar.net`, path `/`. + - Space: folder `/vault`, address `nisse-memory.dongar.net`, path `/`. diff --git a/deploy/agent-host/caddy/vault.dongar.net.caddy b/deploy/agent-host/caddy/nisse-memory.dongar.net.caddy similarity index 93% rename from deploy/agent-host/caddy/vault.dongar.net.caddy rename to deploy/agent-host/caddy/nisse-memory.dongar.net.caddy index 9afa56a..2c08157 100644 --- a/deploy/agent-host/caddy/vault.dongar.net.caddy +++ b/deploy/agent-host/caddy/nisse-memory.dongar.net.caddy @@ -1,6 +1,6 @@ # The vault's SilverBullet, for the operator's Caddy on docker.garrett-hall.com # (/opt/stacks). HTTPS from Caddy's usual automatic certificate; LAN only. -vault.dongar.net { +nisse-memory.dongar.net { # Anyone outside the LAN gets nothing. Caddy still answers Let's Encrypt's # checks, which it handles before the site's own routes. @outside not remote_ip private_ranges diff --git a/deploy/agent-host/setup.sh b/deploy/agent-host/setup.sh index 0026503..f76bbdc 100755 --- a/deploy/agent-host/setup.sh +++ b/deploy/agent-host/setup.sh @@ -7,7 +7,7 @@ set -euo pipefail here=$(cd "$(dirname "$0")" && pwd) # The only address allowed to reach SilverBullet: the operator's Caddy -# (docker.garrett-hall.com), which serves vault.dongar.net to the LAN. +# (docker.garrett-hall.com), which serves nisse-memory.dongar.net inside garrett-hall.com. CADDY_ADDR=192.168.6.13 SB_PORT=3000 SB_UID=1000 # the image's PUID/PGID: the operator's side of the vault diff --git a/docs/Development-Plan.md b/docs/Development-Plan.md index abc1132..fbd9c2d 100644 --- a/docs/Development-Plan.md +++ b/docs/Development-Plan.md @@ -539,9 +539,9 @@ for `nisse-ops` there now: read-only, and nothing else of the host but its own data. - SilverBullet's version is pinned (the docker role updates images nightly). Its accounts are its own, made in its setup wizard. -- Decided with the operator: behind their Caddy at `vault.dongar.net` for HTTPS, - the LAN only, with no Authelia (an internal instance; SilverBullet's own login - is enough), and its own instance rather than the operator's personal one, so +- Decided with the operator: behind their Caddy at `nisse-memory.dongar.net` for + HTTPS, inside garrett-hall.com only, with no Authelia (an internal instance; + SilverBullet's own login is enough), and its own instance rather than the operator's personal one, so the vault stays one local copy with mounts enforcing its writers. On the host, a `DOCKER-USER` rule lets only Caddy reach it. diff --git a/tests/deploy/test_agent_host.py b/tests/deploy/test_agent_host.py index 0e947e9..21f0b62 100644 --- a/tests/deploy/test_agent_host.py +++ b/tests/deploy/test_agent_host.py @@ -70,7 +70,7 @@ def test_no_secrets_in_the_compose_file() -> None: def test_its_port_caddys_and_the_firewalls_agree() -> None: port = setting("SB_PORT") assert silverbullet()["ports"] == [f"0.0.0.0:{port}:3000"] # IPv4 only - caddy = (HOST / "caddy" / "vault.dongar.net.caddy").read_text() + caddy = (HOST / "caddy" / "nisse-memory.dongar.net.caddy").read_text() assert f"reverse_proxy nisse.garrett-hall.com:{port}" in caddy assert "@outside not remote_ip private_ranges" in caddy # the LAN only