diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -80,7 +80,7 @@ service module: - `caddy.nix` — the main thing that binds to 80/443 (see `adguard.nix` below for the one exception). Reverse-proxies each subdomain to a service's localhost port; the `dns.karanj.com` vhost additionally serves the ACME HTTP-01 webroot for `acme.nix`. Application ports (5006, - 8080, 8086) are bound to `127.0.0.1` and never exposed directly — Caddy is the public HTTP(S) + 5230, 8080, 8086) are bound to `127.0.0.1` and never exposed directly — Caddy is the public HTTP(S) entry point for everything except AdGuard's encrypted-DNS ports, and handles Let's Encrypt automatically for its own certs. - `adguard.nix` — AdGuard Home; plain DNS (`dns.port`) is set to `0` and deliberately not opened @@ -108,6 +108,10 @@ service module: - `actual.nix` — Actual Budget via the native `services.actual` module (ships in this flake's pinned nixpkgs). No secrets involved; the server password is set interactively on first browser visit. +- `memos.nix` — Memos note-taking app via the native `services.memos` module (ships in this + flake's pinned nixpkgs). Uses the module's default sqlite driver, so no separate database + service is needed (unlike Miniflux's Postgres). No secrets involved; the first account is + created interactively in the web UI on first visit. - `cgit.nix` — git hosting. Three-way access split: web browsing is public/unauthenticated via cgit, `git clone`/`pull` over HTTPS is public/read-only via `git-http-backend` + fcgiwrap, and `git push` is SSH-only through a dedicated `git` system user with its own authorized keys. cgit |