diff --git a/.gitignore b/.gitignore index 5d24f20..4c2c154 100644 --- a/.gitignore +++ b/.gitignore @@ -41,8 +41,6 @@ blog/traffic-analytics-data/ karakeep/data/ karakeep/meilisearch-data/ karakeep/meilisearch-data-old-1.11.1/ -healthlog/data/ -healthlog/pgdata/ apprise/config/ uptime-kuma/data/ ntfy/data/ diff --git a/README.md b/README.md index 67e2fb5..c787486 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,6 @@ in front of the lot. | Contact sync (this repo) | — (no URL; launchd job) | Mac (cross-provider address-book sync: Proton + Google + 2× Microsoft → one canonical store, git-versioned on Forgejo) | | [ntfy](https://github.com/binwiederhier/ntfy) | `ntfy.mathewcsims.uk` | Pi (self-hosted push notifications — on trial alongside Discord; auth default-deny, fed by Apprise) | | Trivy scan (this repo) | — (no URL; launchd job) | Mac (weekly vulnerability scan of every pinned image in the repo, notifies on new CVEs) | -| [HealthLog](https://github.com/MBombeck/HealthLog) | `healthlog.mathewcsims.uk` | Mac (self-hosted health tracking: vitals, sleep, mood questionnaires, Samsung Health sync — **medications moved off to [MedTimer](https://github.com/Futsch1/medTimer) 2026-08-04**, see SETUP.md; PolyForm Noncommercial licensed, passkey-only login, registration disabled after initial setup) | | [chhoto-url](https://github.com/SinTan1729/chhoto-url) | `msims.link` | Pi (self-hosted URL shortener on its own short domain — bare root redirects to `mathewcsims.uk` rather than showing the shortener's own login screen) | | [Wanderer](https://github.com/open-wanderer/wanderer) | `wanderer.mathewcsims.uk` | Mac (self-hosted GPS trail/cycle-ride log — GPX/FIT/TCX/KML import; Meilisearch + PocketBase sidecars; posts a Memo to Owl on every new ride via a PocketBase-realtime relay) | | [Immich](https://immich.app) | `immich.mathewcsims.uk` | **slartibartfast** (self-hosted photo/video library with local CLIP semantic search + face recognition — first app on the third host; LAN/tailnet-only, local accounts, no public sharing) | @@ -40,7 +39,8 @@ in front of the lot. ### Decommissioned -Four apps were torn down on **2026-08-04** for not earning their keep: +Five apps have been torn down for not earning their keep — four on +**2026-08-04**, and HealthLog on **2026-08-07**: - **Marque** — a private, work-focused third Memos instance (2 memos, 1 user). - **Nimbus** — `dashboard.mathewcsims.uk`, the Pi-resident homelab dashboard. @@ -48,6 +48,10 @@ Four apps were torn down on **2026-08-04** for not earning their keep: Infomaniak SSO (zero time records logged). - **Speedtest Tracker** — `speedtest.mathewcsims.uk`, Pi-resident and LAN-only, polling every 15 minutes (3,135 results kept). +- **HealthLog** — `healthlog.mathewcsims.uk`, self-hosted health tracking. + Medication tracking had already moved to [MedTimer](https://github.com/Futsch1/medTimer) + on 2026-08-04, and a better solution now covers the rest. 38,587 + measurements and 116 workouts preserved in the final dump. Containers, images, volumes, networks, Caddy site blocks, Uptime Kuma monitors and DNS records are all gone; their compose projects live on only @@ -59,7 +63,8 @@ on the relevant host — which is itself a Kopia source, so the archives ride along with every future backup instead of ageing out of a dormant source's retention. Every archive was restore-tested back out of Backblaze B2 and matched its source by sha256. Each app's Proton Pass item (OIDC client -secrets, JWT secret, Nimbus's DB password, Speedtest's `APP_KEY`) was kept +secrets, JWT secret, Nimbus's DB password, Speedtest's `APP_KEY`, +HealthLog's database password) was kept for the same reason. The rebuild instructions remain in [SETUP.md](SETUP.md), retitled as decommissioned rather than deleted. diff --git a/SETUP.md b/SETUP.md index 9b87d15..d72c427 100644 --- a/SETUP.md +++ b/SETUP.md @@ -117,9 +117,6 @@ section below says which. | `karakeep/compose.yaml` | **Mac** | Karakeep + Meilisearch; reads secrets from Proton Pass | | `karakeep/data/` | **Mac** | **your bookmarks/assets/archives live here** | | `karakeep/meilisearch-data/` | **Mac** | search index | -| `healthlog/compose.yaml` | **Mac** | HealthLog (medication reminders, vitals) + Postgres sidecar; personal health data — see its own section below; reads secrets from Proton Pass | -| `healthlog/data/` | **Mac** | **your health data, encrypted at rest, lives here** | -| `healthlog/pgdata/` | **Mac** | Postgres datadir | | `bookstack/compose.yaml` | **Mac** | BookStack + MariaDB sidecar; LAN-only (`author.mathewcsims.uk`); reads secrets from Proton Pass | | `bookstack/config/` | **Mac** | **your wiki pages/books/shelves live here** | | `bookstack/db/` | **Mac** | **BookStack's MariaDB datadir** | @@ -583,7 +580,7 @@ The Pi runs Tailscale, configured as both a subnet router (advertising the LAN) and an exit node — meaning devices elsewhere can reach this network through it, including while off any physical LAN entirely. Every LAN-gated app in this repo (`mc37`, `apprise`, `vikunja-relay`, `backup`, `author`, -`paperless`, `fj`, `healthlog`, `docs`) +`paperless`, `fj`, `docs`) needs **three** separate things to actually be reachable this way. Each is necessary and none is sufficient, which is what makes this so awkward to debug: with any one missing, every check you can run on the server comes @@ -2285,7 +2282,22 @@ binaries actually run): --- -## HealthLog (https://healthlog.mathewcsims.uk) +## HealthLog (https://healthlog.mathewcsims.uk) — DECOMMISSIONED + +> **DECOMMISSIONED 2026-08-07.** Torn down once a better solution covered +> what was left: medication tracking had already moved to MedTimer on +> 2026-08-04, and the remaining tracking was not being used. Containers, +> images, network, the Caddy site block, the Uptime Kuma monitor and the DNS +> records are all gone; `healthlog/` and +> `scripts/pass-create-healthlog-secrets.sh` were removed from this repo and +> survive only in git history. The section below is kept verbatim as the +> rebuild recipe. THE HEALTH DATA IS KEPT: a final `pg_dump` (133 tables, +> 38,587 measurements, 116 workouts) and a cold `tar.gz` of the whole app +> directory including the Postgres datadir live in +> `db-dumps/decommissioned/` on the Mac, both restore-tested out of +> Backblaze B2 and matched by sha256. The **HealthLog** Proton Pass item was +> deliberately retained. + [HealthLog](https://github.com/MBombeck/HealthLog) — self-hosted health tracker: medication reminders (over ntfy/Web Push/Telegram/APNs), vitals diff --git a/docs/compose.yaml b/docs/compose.yaml index 1bb912d..b923cf5 100644 --- a/docs/compose.yaml +++ b/docs/compose.yaml @@ -50,7 +50,7 @@ services: postgres: # 17-alpine. Pinned by digest, not the tag alone — tags aren't immutable, # so a bare version tag can still silently move. Same pattern as - # ../healthlog/compose.yaml, this repo's other Postgres app. + # ../paperless/compose.yaml and the wider repo convention. image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193 container_name: docs-postgres restart: unless-stopped @@ -144,7 +144,8 @@ services: # published port must be bound to the Mac's *actual* LAN IP — # podman-machine cannot bind 0.0.0.0 to the real interface. The Pi's # reverse proxy connects to this address. 3000 is HedgeDoc's own default - # but karakeep already holds it (the same reason healthlog took 3200), + # but karakeep already holds it (the same reason healthlog took 3200 + # before it was decommissioned), # so 3500. The router does NOT forward 3500, so this is never directly # internet-facing even before the Caddy LAN-gate is considered. - "10.0.1.14:3500:3000" diff --git a/healthlog/compose.yaml b/healthlog/compose.yaml deleted file mode 100644 index 43f3eb8..0000000 --- a/healthlog/compose.yaml +++ /dev/null @@ -1,131 +0,0 @@ -# HealthLog — self-hosted health tracker (medication reminders, vitals, -# wellness signals). Added 2026-07-26 as a Pillo replacement. Personal -# health data, single user, public hostname — access control and data -# protection are the top priority for this one specifically (see -# pi-reverse-proxy/Caddyfile's HealthLog block for the deployment-time -# IP-allowlist used to close the "first registrant becomes admin" window, -# and SETUP.md for the full writeup). -# -# Upstream: https://github.com/MBombeck/HealthLog — PolyForm Noncommercial -# 1.0.0 licensed (source-available, not OSI open-source; free for this -# personal noncommercial self-hosted use). Reference compose: -# https://github.com/MBombeck/HealthLog/blob/main/docker-compose.yml -# -# Secrets (POSTGRES_PASSWORD, ENCRYPTION_KEY, API_TOKEN_HMAC_KEY) come from -# the "HealthLog" Proton Pass item via scripts/pass-deploy.sh — created by -# scripts/pass-create-healthlog-secrets.sh (run under your own pass-cli -# session, not the agent's — see that script's own header for why). -# -# Medication-reminder notification loop (fires every 15 min indefinitely, -# reported 2026-07-27, recurred 2026-07-28) — root cause CONFIRMED and -# FIXED upstream, resolved by updating the image: -# The reminder tick's "already sent today" dedup used to be keyed off -# the Telegram message ledger, which only gets a row when a Telegram -# send succeeds. This deployment notifies via ntfy, not Telegram, so -# that ledger never had a row for it — the dedup check always saw -# "not yet sent" and the 15-minute tick re-fired forever, regardless -# of whether the dose was later logged in-window. Confirmed via the -# container's own structured logs (repeated `sendNotification` calls -# at the same phase/slot every 15 min) and the upstream source -# (src/lib/notifications/reminder-dedup.ts). -# Fixed upstream in v1.33.1 (2026-07-27, commit c6b944b) — moved the -# dedup anchor to the channel-agnostic `push_attempts` table. Our -# image was pinned to `:latest` but hadn't been recreated since -# 2026-07-25 (podman doesn't auto-pull `:latest` on `compose up`), so -# it was still running the old logic two days after the fix shipped. -# Fixed by explicitly `podman pull`-ing and redeploying via -# `./scripts/pass-deploy.sh healthlog HealthLog` (2026-07-28), now on -# v1.33.2. Lesson: `:latest` here means "latest at the time the -# container was last recreated", not "actually latest" — there's no -# watchtower/auto-update on this app, so a real fix landing upstream -# doesn't reach the running container until someone manually pulls. - -name: healthlog - -services: - postgres: - # 2026-08-02: was the last bare (undigested) tag in the repo — pinned to - # close that gap, not to fix a CVE. 16.14-alpine carries 15 fixable - # HIGH findings and they are NOT fixable here: every one is a Go stdlib - # CVE in the image's helper binary, waiting on a rebuild with a newer - # toolchain. Checked before pinning — 17-alpine has the same 15, and - # 18-alpine 16, so a major-version upgrade fixes nothing and would be a - # data migration for no benefit. The Debian variant is markedly worse - # (17 unfixed CRITICAL, 38 unfixed HIGH), so alpine stays. - image: postgres:16.14-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 - container_name: healthlog-postgres - restart: unless-stopped - security_opt: - - no-new-privileges:true - environment: - POSTGRES_USER: healthlog - POSTGRES_DB: healthlog - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} - volumes: - - ./pgdata:/var/lib/postgresql/data - healthcheck: - test: ["CMD-SHELL", "pg_isready -U healthlog"] - interval: 5s - timeout: 5s - retries: 5 - mem_limit: 1g - pids_limit: 256 - - web: - # No dedicated release tag scheme documented beyond `:latest` in - # upstream's own reference compose — pinned to a digest anyway, same - # discipline as every other app here. Multi-arch (amd64+arm64), GHCR. - # 2026-08-02: the comment above claimed this was digest-pinned while the - # image line was still `:latest`. Actually pinned now. - image: ghcr.io/mbombeck/healthlog@sha256:e9cf5d7219b205df6cb4346d3da8a63f5973a9b7f3ab187bacd8fd3663365a38 - container_name: healthlog - restart: unless-stopped - security_opt: - - no-new-privileges:true - depends_on: - postgres: - condition: service_healthy - environment: - NODE_ENV: production - # No TZ was ever set here, so the container ran on the image's own - # baked-in default (Europe/Berlin, confirmed live via `date`/Node's - # Intl.DateTimeFormat) — mismatched against Mathew's actual London - # profile timezone (users.timezone, set in-app) by a full hour in - # summer. The in-app profile timezone setting only affects the - # database row — it can't reach into the container's own OS clock, - # so this has to be set here explicitly. Worth fixing on its own - # merits, but NOTE: this was originally found while chasing a - # medication-reminder notification loop (2026-07-27) that turned - # out to be unrelated — see the loop's real root cause and fix - # below. - TZ: Europe/London - DATABASE_URL: postgresql://healthlog:${POSTGRES_PASSWORD}@postgres:5432/healthlog - ENCRYPTION_KEY: ${ENCRYPTION_KEY} - API_TOKEN_HMAC_KEY: ${API_TOKEN_HMAC_KEY} - - # Must match the Caddy-fronted public hostname exactly — WebAuthn - # passkeys are bound to this origin at registration time, and the - # background job runner needs APP_URL for the same URLs server-side. - NEXT_PUBLIC_APP_URL: https://healthlog.mathewcsims.uk - APP_URL: https://healthlog.mathewcsims.uk - - # Real HTTPS throughout (Caddy terminates TLS on the Pi) — cookies - # must be marked Secure, never relaxed for this app. - SESSION_COOKIE_SECURE: "true" - volumes: - - ./data:/app/data - ports: - # Host port 3200, not 3000 — karakeep already has 3000. Same - # podman-machine quirk as every other Mac app here: a published port - # must be bound to the Mac's actual LAN IP, not 0.0.0.0. Never - # directly internet-facing — the router doesn't forward 3200, and - # the only path in is through Caddy on the Pi. - - "10.0.1.14:3200:3000" - healthcheck: - test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/health"] - interval: 30s - timeout: 5s - retries: 3 - start_period: 30s - mem_limit: 1g - pids_limit: 256 diff --git a/immich/compose.yaml b/immich/compose.yaml index 2b428c4..583f8e8 100644 --- a/immich/compose.yaml +++ b/immich/compose.yaml @@ -32,7 +32,7 @@ # # Exposure: LAN/tailnet-gated behind Caddy (immich.mathewcsims.uk), never # internet-reachable. Registration must be closed once the one real account -# exists — same first-registrant-becomes-admin race as HealthLog/Wanderer. +# exists — same first-registrant-becomes-admin race as Wanderer. # # v3.1.0's only breaking change is dropping iOS 14 support — irrelevant for # a fresh install. Immich ships breaking changes regularly, so read the @@ -83,7 +83,7 @@ services: condition: service_healthy environment: # Reached by SERVICE name over the project's default network, same as - # HealthLog's postgres sidecar — not container name, not IP. + # a postgres sidecar — not container name, not IP. DB_HOSTNAME: database DB_USERNAME: immich DB_DATABASE_NAME: immich @@ -177,7 +177,7 @@ services: database: # Immich's OWN Postgres image, not stock postgres — it carries # VectorChord + pgvecto.rs, the vector extensions smart search depends - # on. Deliberately NOT aligned with HealthLog's postgres:16-alpine; + # on. Deliberately NOT aligned with the repo's other postgres pins; # substituting stock Postgres breaks Immich outright. Digest is # upstream's own pin. image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 diff --git a/kopia-mac/backup.sh b/kopia-mac/backup.sh index 0be33ce..abf5753 100755 --- a/kopia-mac/backup.sh +++ b/kopia-mac/backup.sh @@ -121,8 +121,8 @@ echo $$ > "$LOCK_DIR/pid" trap 'rm -rf "$LOCK_DIR"' EXIT INT TERM # Dump every database to a consistent, restorable file BEFORE snapshotting -# anything. Without this, the datadir paths below (healthlog/pgdata, -# blog/db, bookstack/db, and every SQLite file) are copied while their +# anything. Without this, the datadir paths below (blog/db, bookstack/db, +# and every SQLite file) are copied while their # services are running, which can capture torn pages or a .db and -wal that # disagree — a backup that looks valid until you try to restore it. See # scripts/dump-databases.sh for the per-engine reasoning. @@ -144,7 +144,8 @@ fi # it into copyparty/data or the NAS mount below and it would be swept up # here with no change to this file. That was considered and declined: # backup is Syncthing -> Proton Drive, off this repo's infrastructure -# entirely. Don't wire it in. See SETUP.md's HealthLog section for the +# entirely. Don't wire it in. See SETUP.md's (now decommissioned) +# HealthLog section for the # full reasoning (incl. why the copyparty route would cost vague-403). # # Paperless is deliberately HALF a source. paperless/data (SQLite db, Tantivy @@ -218,8 +219,6 @@ SOURCES=" $REPO_ROOT/db-dumps $REPO_ROOT/karakeep/data $REPO_ROOT/karakeep/meilisearch-data -$REPO_ROOT/healthlog/data -$REPO_ROOT/healthlog/pgdata $REPO_ROOT/vikunja/db $REPO_ROOT/vikunja/files $REPO_ROOT/blog/db diff --git a/litellm/compose.yaml b/litellm/compose.yaml index 5468df3..d249dcd 100644 --- a/litellm/compose.yaml +++ b/litellm/compose.yaml @@ -74,7 +74,8 @@ name: litellm services: db: - # Same pin as HealthLog's Postgres — one CVE review covers both, and its + # Was the same pin as HealthLog's Postgres (decommissioned 2026-08-07); + # kept for continuity, and its # position is already documented (15 fixable HIGHs, all Go stdlib in a # helper binary, no better alternative — see SETUP.md). image: postgres:16.14-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 diff --git a/pi-reverse-proxy/Caddyfile b/pi-reverse-proxy/Caddyfile index f6cb346..b98f001 100644 --- a/pi-reverse-proxy/Caddyfile +++ b/pi-reverse-proxy/Caddyfile @@ -609,8 +609,9 @@ author.mathewcsims.uk { # clients — same @lan/abort idiom as BookStack and Forgejo below. # # LAN-gating matters more here than for most: this instance holds personal -# medical documents, official correspondence and identity paperwork. Same -# priority as HealthLog further down, and for the same reason. +# medical documents, official correspondence and identity paperwork — +# access control is the top priority for this app specifically, more so +# than anywhere else left in this repo. # # Paperless serves its login form at /accounts/login/ (Django allauth). # Rather than assume its built-in throttling is sufficient, this gets the @@ -692,54 +693,6 @@ fj.mathewcsims.uk { } } -# ── HealthLog (running on the Mac) ─────────────────────────────────────── -# Clean public URL https://healthlog.mathewcsims.uk. Personal health data -# (medications, vitals) — access control is the top priority for this app -# specifically, more so than anywhere else in this repo. -# -# Deployed 2026-07-26 with a temporary IP-allowlist (home public IP + LAN -# range) covering the setup window — HealthLog has no setup token, so -# whoever registers the very first account becomes admin, and the TLS cert -# issuance publishes this hostname to public Certificate Transparency logs -# within minutes regardless of DNS propagation. Removed here once Mathew -# completed passkey registration as the first (admin) user and disabled -# registration in HealthLog's own admin panel — the real, permanent access -# control from this point on is: registration closed + passkey-only login -# (no password fallback configured) + the rate limit below. -healthlog.mathewcsims.uk { - import access_log - import security_headers - import general_ratelimit healthlog - - # HealthLog has no documented built-in rate limiting on its passkey/ - # auth endpoints (confirmed against its docs) — same defense-in-depth - # reasoning as every other app's auth endpoint in this repo. Broad - # path match since the exact WebAuthn route names aren't documented; - # narrow this once confirmed live. - rate_limit { - zone rl_healthlog_auth { - match { - path /api/auth/* - } - key {remote_host} - events 15 - window 1m - } - } - - # flush_interval -1 disables response buffering — required for - # HealthLog's streaming "Coach" feature (documented upstream - # requirement); explicit X-Forwarded-* headers match HealthLog's own - # reference reverse-proxy example, even though these already match - # Caddy's defaults. - reverse_proxy http://{$MAC_IP}:3200 { - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - header_up Host {host} - flush_interval -1 - } -} - # ── Wanderer (running on the Mac) ───────────────────────────────────────── # Self-hosted GPS trail/ride log. The setup-time IP-allowlist (protecting # against the first-registrant-becomes-admin race — PUBLIC_DISABLE_SIGNUP diff --git a/scripts/dump-databases.sh b/scripts/dump-databases.sh index 047c8e9..2032a2e 100755 --- a/scripts/dump-databases.sh +++ b/scripts/dump-databases.sh @@ -5,7 +5,7 @@ # ── WHY THIS EXISTS ─────────────────────────────────────────────────────── # Until this script, EVERY database in this repo was backed up by # snapshotting its live data directory while the service was running — -# healthlog/pgdata, blog/db, bookstack/db, plus a pile of SQLite files in +# blog/db, bookstack/db, plus a pile of SQLite files in # WAL mode. That is not a backup. A file-level copy of a running Postgres # or MySQL datadir can capture torn pages and a half-written WAL, and a # WAL-mode SQLite copy can capture a .db and -wal that disagree. The result @@ -228,7 +228,9 @@ dump_sqlite() { echo "=== dumping databases -> $OUT ===" -dump_postgres healthlog-postgres healthlog healthlog healthlog +# HealthLog decommissioned 2026-08-07 (medication tracking moved to +# MedTimer, the rest unused) — its final pg_dump and a cold archive of +# the whole app directory live in db-dumps/decommissioned/. # HedgeDoc. Note this dump is the notes themselves; images pasted into notes # live in docs/uploads/ and are covered by the Kopia source instead, not here. dump_postgres docs-postgres hedgedoc hedgedoc docs @@ -281,7 +283,7 @@ done # at all — counts as broken, which is exactly how that incident presented. UNHEALTHY="" echo "=== post-dump health check ===" -for _host in owl prospect-ukri-tus vikunja karakeep wanderer fj healthlog blog author docs; do +for _host in owl prospect-ukri-tus vikunja karakeep wanderer fj blog author docs; do _code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "https://$_host.mathewcsims.uk/" 2>/dev/null || true) [ -z "$_code" ] && _code=000 case "$_code" in diff --git a/scripts/pass-create-healthlog-secrets.sh b/scripts/pass-create-healthlog-secrets.sh deleted file mode 100755 index e57a460..0000000 --- a/scripts/pass-create-healthlog-secrets.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/sh -# One-time setup: generates HealthLog's three required secrets -# (POSTGRES_PASSWORD, ENCRYPTION_KEY, API_TOKEN_HMAC_KEY — all 32-byte hex, -# per HealthLog's own .env.example) and stores them as a new Proton Pass -# item, "HealthLog", for healthlog/ to read at deploy time via -# scripts/pass-deploy.sh, same as every other app in this repo. -# -# Deliberately NOT run by the agent — pass-cli agent PATs are read-only by -# design, so item creation has to happen under your own personal pass-cli -# session, not the agent one used elsewhere in this repo's tooling. -# -# Secrets are generated INSIDE this script and go straight into Pass — -# never typed, never printed, never touch argv or a file on disk. -# -# Usage: -# ./scripts/pass-create-healthlog-secrets.sh -set -eu - -POSTGRES_PASSWORD=$(openssl rand -hex 32) -ENCRYPTION_KEY=$(openssl rand -hex 32) -API_TOKEN_HMAC_KEY=$(openssl rand -hex 32) - -printf '{"title":"HealthLog","note":"self-hosted repo secrets — see ~/self-hosted/healthlog/","sections":[{"section_name":"Secrets","fields":[{"field_name":"POSTGRES_PASSWORD","field_type":"hidden","value":"%s"},{"field_name":"ENCRYPTION_KEY","field_type":"hidden","value":"%s"},{"field_name":"API_TOKEN_HMAC_KEY","field_type":"hidden","value":"%s"}]}]}' \ - "$POSTGRES_PASSWORD" "$ENCRYPTION_KEY" "$API_TOKEN_HMAC_KEY" \ - | pass-cli item create custom --vault-name "Self-Hosted Secrets" --from-template - - -echo -echo "Done. \"HealthLog\" item created in Proton Pass with POSTGRES_PASSWORD," -echo "ENCRYPTION_KEY, and API_TOKEN_HMAC_KEY — nothing printed here, values" -echo "went straight from openssl into Pass." diff --git a/wanderer/compose.yaml b/wanderer/compose.yaml index 8cbda9d..80da32d 100644 --- a/wanderer/compose.yaml +++ b/wanderer/compose.yaml @@ -3,7 +3,7 @@ # import. Upstream calls its own KML support "experimental", but confirmed # working directly in real use (2026-07-28) — imports KML rides natively, # no gpsbabel/GPX conversion step needed in practice. Runs on the Mac, same -# pattern as karakeep/healthlog — Caddy on the Pi terminates TLS and +# pattern as karakeep — Caddy on the Pi terminates TLS and # proxies to plain HTTP here. # # ── Security review before deploying ────────────────────────────────────── @@ -22,7 +22,8 @@ # # Registration: PUBLIC_DISABLE_SIGNUP defaults to "false" (signup OPEN) in # upstream's own reference compose — same "first registrant becomes admin" -# race as HealthLog's initial setup. Handled the same way: a temporary +# race as HealthLog's initial setup was (decommissioned 2026-08-07). +# Handled the same way: a temporary # Caddy IP-allowlist during first bring-up (see pi-reverse-proxy/Caddyfile), # removed once the one real account is registered and PUBLIC_DISABLE_SIGNUP # is flipped to "true" and redeployed.