Agent host: the site is nisse-memory.dongar.net, inside garrett-hall.com

The operator renamed the site from vault.dongar.net.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/README.md

@@ -16,8 +16,9 @@ later (M6.1).
   (Docker's `DOCKER-USER` chain, re-applied whenever Docker starts).
 - `check.sh`: run on the host by `scripts/agent-host.sh check`; says "all
   checks passed" only once every check has run.
-- `caddy/vault.dongar.net.caddy`: the site for the operator's Caddy on
+- `caddy/nisse-memory.dongar.net.caddy`: the site for the operator's Caddy on
-  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, LAN only.
+  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, inside
+  garrett-hall.com only.
 
 ## The vault
 
@@ -42,10 +43,10 @@ scripts/agent-host.sh check     # running, mounts, firewall
 
 Then:
 
-1. **The operator adds the Caddy site** from `caddy/vault.dongar.net.caddy`
+1. **The operator adds the Caddy site** from `caddy/nisse-memory.dongar.net.caddy`
    and reloads Caddy.
 2. **The operator runs SilverBullet's setup wizard at once,** at
-   `https://vault.dongar.net`. Until it's done, whoever opens the page first
+   `https://nisse-memory.dongar.net`. Until it's done, whoever opens the page first
    makes the administrator account.
    - Account: the operator's, with a strong password.
-   - Space: folder `/vault`, address `vault.dongar.net`, path `/`.
+   - Space: folder `/vault`, address `nisse-memory.dongar.net`, path `/`.

deploy/agent-host/caddy/nisse-memory.dongar.net.caddy

@@ -1,6 +1,6 @@
 # The vault's SilverBullet, for the operator's Caddy on docker.garrett-hall.com
 # (/opt/stacks). HTTPS from Caddy's usual automatic certificate; LAN only.
-vault.dongar.net {
+nisse-memory.dongar.net {
 	# Anyone outside the LAN gets nothing. Caddy still answers Let's Encrypt's
 	# checks, which it handles before the site's own routes.
 	@outside not remote_ip private_ranges

deploy/agent-host/setup.sh

@@ -7,7 +7,7 @@ set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
 
 # The only address allowed to reach SilverBullet: the operator's Caddy
-# (docker.garrett-hall.com), which serves vault.dongar.net to the LAN.
+# (docker.garrett-hall.com), which serves nisse-memory.dongar.net inside garrett-hall.com.
 CADDY_ADDR=192.168.6.13
 SB_PORT=3000
 SB_UID=1000  # the image's PUID/PGID: the operator's side of the vault

docs/Development-Plan.md

@@ -539,9 +539,9 @@ for `nisse-ops` there now:
   read-only, and nothing else of the host but its own data.
 - SilverBullet's version is pinned (the docker role updates images nightly).
   Its accounts are its own, made in its setup wizard.
-- Decided with the operator: behind their Caddy at `vault.dongar.net` for HTTPS,
+- Decided with the operator: behind their Caddy at `nisse-memory.dongar.net` for
-  the LAN only, with no Authelia (an internal instance; SilverBullet's own login
+  HTTPS, inside garrett-hall.com only, with no Authelia (an internal instance;
-  is enough), and its own instance rather than the operator's personal one, so
+  SilverBullet's own login is enough), and its own instance rather than the operator's personal one, so
   the vault stays one local copy with mounts enforcing its writers. On the host,
   a `DOCKER-USER` rule lets only Caddy reach it.
 

tests/deploy/test_agent_host.py

@@ -70,7 +70,7 @@ def test_no_secrets_in_the_compose_file() -> None:
 def test_its_port_caddys_and_the_firewalls_agree() -> None:
     port = setting("SB_PORT")
     assert silverbullet()["ports"] == [f"0.0.0.0:{port}:3000"]  # IPv4 only
-    caddy = (HOST / "caddy" / "vault.dongar.net.caddy").read_text()
+    caddy = (HOST / "caddy" / "nisse-memory.dongar.net.caddy").read_text()
     assert f"reverse_proxy nisse.garrett-hall.com:{port}" in caddy
     assert "@outside not remote_ip private_ranges" in caddy  # the LAN only