Caddy's network had IPv4 alone, so Docker's userland proxy forwarded
every IPv6 visitor to Caddy from the network's gateway, and the server
counted all of them as one network (the second reading's M5, reasoned).
The edge network gets a unique local /64 (fd4a:6c6b:7e80::/64), Caddy a
fixed address in it beside its IPv4 one, both trusted as the proxy; the
CI runner's unit denies fd00::/8 and its sandbox check tries Caddy's IPv6
address too. A commit of its own: it needs Docker 27 or later with
ip6tables on the server and the network made anew (compose down, never
-v, then up), checked by hand first (NEXT.md).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
With Jellyfin's default of three failed tries, anyone could switch the
demo off with three wrong passwords; an account without a password has
nothing for the lockout to guard. The runbook also says how people sign
in to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
rsync has to be installed on both ends, and learn.halkyon.eu's server
has none; tar through SSH needs nothing the server lacks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
The sidecar's steps made Jellyfin's user with its own group, to which
useradd gave a system group ID (987 on learn.halkyon.eu's server), while
compose.jellyfin.yaml runs it as 61096:61096. The group is now made
first with the same ID, and the steps say why useradd's warning about an
ID above the system range is meant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.
The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
