diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 12 |
1 files changed, 11 insertions, 1 deletions
@@ -10,6 +10,7 @@ A flake-based, modular NixOS configuration for a personal server running in Euro | https://rss.karanj.com | Miniflux (RSS/Atom reader) | | https://budget.karanj.com | Actual Budget (personal finance) | | https://git.karanj.com | cgit (git repository browser) | +| https://notes.karanj.com | Memos (note-taking) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. AdGuard also listens directly on **853/tcp** for DNS-over-TLS and **8443/tcp** for @@ -37,6 +38,7 @@ modules/ miniflux.nix Miniflux + PostgreSQL actual.nix Actual Budget cgit.nix cgit + fcgiwrap + git push user + memos.nix Memos (note-taking) ``` --- @@ -164,6 +166,7 @@ dns.karanj.com A <server-ipv4> rss.karanj.com A <server-ipv4> budget.karanj.com A <server-ipv4> git.karanj.com A <server-ipv4> +notes.karanj.com A <server-ipv4> ``` Or a single wildcard: `*.karanj.com A <server-ipv4>`. @@ -221,6 +224,7 @@ joined to your tailnet first), then: | Miniflux | https://rss.karanj.com | Log in with `admin` (or your `ADMIN_USERNAME`) + your sops password | | Actual Budget | https://budget.karanj.com | Set a server password in the browser on first visit - no pre-configuration needed | | cgit | https://git.karanj.com | No login needed - public read-only | +| Memos | https://notes.karanj.com | Create the first account directly in the web UI on first visit | To use the server as your device's DNS resolver, configure DNS-over-TLS or DNS-over-HTTPS as described under [AdGuard Home](#adguard-home) below - plain DNS (port 53) is disabled. @@ -312,6 +316,12 @@ and restart the service: `systemctl restart actual`. - **Clone/Pull:** `git clone https://git.karanj.com/<repo>.git` (public, read-only) - **Push:** SSH only - `git push git@<server-ipv4>:/srv/git/<repo>.git` +### Memos + +Data is stored as a sqlite database under `/var/lib/memos/`. No password reset flow needed +beyond what the web UI itself offers - it's a single-user instance with no separate admin +credentials in this config. + ### Caddy / TLS TLS certificates are obtained automatically from Let's Encrypt on first startup (registered to @@ -331,7 +341,7 @@ Caddy logs: `journalctl -u caddy -f` | 853 | TCP | DNS-over-TLS (AdGuard Home) | | 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | -All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to +All other ports are closed at the firewall. App-level ports (5006, 5230, 8080, 8086) are bound to 127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required so its DoH/DoT listener - which shares the same bind host - reaches the public interface), but stays unreachable externally because the firewall never opens port 3000. |