Tizian 「ティツィアーン」
4b45cacfa4
An instance may now run services beside itself, each a compose file of its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose. jellyfin.yaml), so the deploy runs them with the instance. The first is Jellyfin, which people watch and listen to learn from: the instance then suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its site, refusing every change to a user from outside, so a passwordless demo account stays everyone's; its admin signs in through an SSH tunnel. The instance's compose gets a second network, `edge`, for Caddy (at a fixed address, which sidecars trust as their proxy) and the server; Postgres stays on the internal one. Caddy loses its needless way to Postgres, and a sidecar never gains one. A sidecar publishes no port, as the CI runner may reach 127.0.0.1, and runs as a user ID of its own. Caddy imports the sidecars' sites from sidecars/, mounted by their compose files (none without), and redeploy.sh recreates it when one changes. sidecars/README.md has the steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
17 lines
657 B
Text
17 lines
657 B
Text
# The Jellyfin sidecar's site (compose.jellyfin.yaml).
|
|
{$JELLYFIN_DOMAIN} {
|
|
# Its demo account (sidecars/README.md) has no password and is everyone's: nobody
|
|
# may change a user from outside (give it a password, change its settings or its
|
|
# picture), only sign in. Halkyon Learn writes nothing else under /Users. The setup
|
|
# wizard is closed too. The admin works through an SSH tunnel, which doesn't pass
|
|
# here.
|
|
@userChanges {
|
|
method POST PUT DELETE
|
|
path /Users/* /UserImage /UserImage/*
|
|
not path /Users/AuthenticateByName /Users/AuthenticateWithQuickConnect
|
|
}
|
|
respond @userChanges 403
|
|
respond /Startup/* 403
|
|
|
|
reverse_proxy jellyfin:8096
|
|
}
|