From b915129dcf6c0043df3c629fe938986da661340f Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Fri, 31 Jul 2026 21:27:22 +0200 Subject: Added a memos instance --- README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'README.md') diff --git a/README.md b/README.md index 6cae516..d98fdb3 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ A flake-based, modular NixOS configuration for a personal server running in Euro | https://rss.karanj.com | Miniflux (RSS/Atom reader) | | https://budget.karanj.com | Actual Budget (personal finance) | | https://git.karanj.com | cgit (git repository browser) | +| https://notes.karanj.com | Memos (note-taking) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. AdGuard also listens directly on **853/tcp** for DNS-over-TLS and **8443/tcp** for @@ -37,6 +38,7 @@ modules/ miniflux.nix Miniflux + PostgreSQL actual.nix Actual Budget cgit.nix cgit + fcgiwrap + git push user + memos.nix Memos (note-taking) ``` --- @@ -164,6 +166,7 @@ dns.karanj.com A rss.karanj.com A budget.karanj.com A git.karanj.com A +notes.karanj.com A ``` Or a single wildcard: `*.karanj.com A `. @@ -221,6 +224,7 @@ joined to your tailnet first), then: | Miniflux | https://rss.karanj.com | Log in with `admin` (or your `ADMIN_USERNAME`) + your sops password | | Actual Budget | https://budget.karanj.com | Set a server password in the browser on first visit - no pre-configuration needed | | cgit | https://git.karanj.com | No login needed - public read-only | +| Memos | https://notes.karanj.com | Create the first account directly in the web UI on first visit | To use the server as your device's DNS resolver, configure DNS-over-TLS or DNS-over-HTTPS as described under [AdGuard Home](#adguard-home) below - plain DNS (port 53) is disabled. @@ -312,6 +316,12 @@ and restart the service: `systemctl restart actual`. - **Clone/Pull:** `git clone https://git.karanj.com/.git` (public, read-only) - **Push:** SSH only - `git push git@:/srv/git/.git` +### Memos + +Data is stored as a sqlite database under `/var/lib/memos/`. No password reset flow needed +beyond what the web UI itself offers - it's a single-user instance with no separate admin +credentials in this config. + ### Caddy / TLS TLS certificates are obtained automatically from Let's Encrypt on first startup (registered to @@ -331,7 +341,7 @@ Caddy logs: `journalctl -u caddy -f` | 853 | TCP | DNS-over-TLS (AdGuard Home) | | 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | -All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to +All other ports are closed at the firewall. App-level ports (5006, 5230, 8080, 8086) are bound to 127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required so its DoH/DoT listener - which shares the same bind host - reaches the public interface), but stays unreachable externally because the firewall never opens port 3000. -- cgit v1.3.1