Added a memos instance

1 files changed, 11 insertions, 1 deletions

diff --git a/README.md b/README.md
index 6cae516..d98fdb3 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@ A flake-based, modular NixOS configuration for a personal server running in Euro
 | https://rss.karanj.com    | Miniflux (RSS/Atom reader)               |
 | https://budget.karanj.com | Actual Budget (personal finance)         |
 | https://git.karanj.com    | cgit (git repository browser)            |
+| https://notes.karanj.com  | Memos (note-taking)                      |
 
 All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt.
 AdGuard also listens directly on **853/tcp** for DNS-over-TLS and **8443/tcp** for
@@ -37,6 +38,7 @@ modules/
   miniflux.nix              Miniflux + PostgreSQL
   actual.nix                Actual Budget
   cgit.nix                  cgit + fcgiwrap + git push user
+  memos.nix                 Memos (note-taking)
 ```
 
 ---
@@ -164,6 +166,7 @@ dns.karanj.com    A  <server-ipv4>
 rss.karanj.com    A  <server-ipv4>
 budget.karanj.com A  <server-ipv4>
 git.karanj.com    A  <server-ipv4>
+notes.karanj.com  A  <server-ipv4>
 ```
 
 Or a single wildcard: `*.karanj.com A <server-ipv4>`.
@@ -221,6 +224,7 @@ joined to your tailnet first), then:
 | Miniflux      | https://rss.karanj.com    | Log in with `admin` (or your `ADMIN_USERNAME`) + your sops password               |
 | Actual Budget | https://budget.karanj.com | Set a server password in the browser on first visit - no pre-configuration needed |
 | cgit          | https://git.karanj.com    | No login needed - public read-only                                                |
+| Memos         | https://notes.karanj.com  | Create the first account directly in the web UI on first visit                    |
 
 To use the server as your device's DNS resolver, configure DNS-over-TLS or DNS-over-HTTPS as
 described under [AdGuard Home](#adguard-home) below - plain DNS (port 53) is disabled.
@@ -312,6 +316,12 @@ and restart the service: `systemctl restart actual`.
 - **Clone/Pull:** `git clone https://git.karanj.com/<repo>.git` (public, read-only)
 - **Push:** SSH only - `git push git@<server-ipv4>:/srv/git/<repo>.git`
 
+### Memos
+
+Data is stored as a sqlite database under `/var/lib/memos/`. No password reset flow needed
+beyond what the web UI itself offers - it's a single-user instance with no separate admin
+credentials in this config.
+
 ### Caddy / TLS
 
 TLS certificates are obtained automatically from Let's Encrypt on first startup (registered to
@@ -331,7 +341,7 @@ Caddy logs: `journalctl -u caddy -f`
 | 853  | TCP       | DNS-over-TLS (AdGuard Home)                                           |
 | 8443 | TCP       | DNS-over-HTTPS (AdGuard Home)                                         |
 
-All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to
+All other ports are closed at the firewall. App-level ports (5006, 5230, 8080, 8086) are bound to
 127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required
 so its DoH/DoT listener - which shares the same bind host - reaches the public interface),
 but stays unreachable externally because the firewall never opens port 3000.