dongarandClaude Opus 5.5
eafe1b9f4a
deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and SilverBullet over it: the operator writes the vault, the agents' memory/ is read-only to it, and only the operator's Caddy reaches it, which serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and checks it from here. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
11 lines
420 B
Plaintext
11 lines
420 B
Plaintext
# The vault's SilverBullet, for the operator's Caddy on docker.garrett-hall.com
|
|
# (/opt/stacks). HTTPS from Caddy's usual automatic certificate; LAN only.
|
|
vault.dongar.net {
|
|
# Anyone outside the LAN gets nothing. Caddy still answers Let's Encrypt's
|
|
# checks, which it handles before the site's own routes.
|
|
@outside not remote_ip private_ranges
|
|
respond @outside 403
|
|
|
|
reverse_proxy nisse-host.garrett-hall.com:3000
|
|
}
|