Added a memos instance

1 files changed, 5 insertions, 1 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 6817d40..13310d0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -80,7 +80,7 @@ service module:
 - `caddy.nix` — the main thing that binds to 80/443 (see `adguard.nix` below for the one
   exception). Reverse-proxies each subdomain to a service's localhost port; the `dns.karanj.com`
   vhost additionally serves the ACME HTTP-01 webroot for `acme.nix`. Application ports (5006,
-  8080, 8086) are bound to `127.0.0.1` and never exposed directly — Caddy is the public HTTP(S)
+  5230, 8080, 8086) are bound to `127.0.0.1` and never exposed directly — Caddy is the public HTTP(S)
   entry point for everything except AdGuard's encrypted-DNS ports, and handles Let's Encrypt
   automatically for its own certs.
 - `adguard.nix` — AdGuard Home; plain DNS (`dns.port`) is set to `0` and deliberately not opened
@@ -108,6 +108,10 @@ service module:
 - `actual.nix` — Actual Budget via the native `services.actual` module (ships in this flake's
   pinned nixpkgs). No secrets involved; the server password is set interactively on first
   browser visit.
+- `memos.nix` — Memos note-taking app via the native `services.memos` module (ships in this
+  flake's pinned nixpkgs). Uses the module's default sqlite driver, so no separate database
+  service is needed (unlike Miniflux's Postgres). No secrets involved; the first account is
+  created interactively in the web UI on first visit.
 - `cgit.nix` — git hosting. Three-way access split: web browsing is public/unauthenticated via
   cgit, `git clone`/`pull` over HTTPS is public/read-only via `git-http-backend` + fcgiwrap, and
   `git push` is SSH-only through a dedicated `git` system user with its own authorized keys. cgit