ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a
WireGuard tunnel to the instance at home, with the visitor's address in a
PROXY header, and everything else to ramiel's own Caddy, moved to the
loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and
the SSH jump's 22 alone, and nothing from home to ramiel.
The host at home: sshd with keys alone, the root disk unlocked over SSH at
boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted
from the HDD, and home's end of the tunnel before Docker. An instance behind
the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address
alone, trusts the PROXY header from ramiel alone, and gets its certificates
through TLS-ALPN, without HTTP/3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
ADR 0039: the family's instance halkyon.li on balthasar, with Learn, Todo,
Train, Meditate and Jellyfin, sign-up by approval through SimpleLogin alone,
published through ramiel by WireGuard with TLS passed through by name
(HAProxy), the CI runner moved there in a nightly window, deployed by hand.
Supersedes ADR 0032, whose server end goes with sahaquiel.
ADR 0040: one Instance row in every app's Settings opening a route with
accounts, sign-up, assistants, regions and state; the instance's settings in
a file outside the backups, the keys staying in assistants.env; regions from
CoMaps' polygons, which the sidecars build themselves.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
