Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

plans/homelab-improvements/tasks/TB-033-public-surface-audit.md

@@ -1,7 +1,7 @@
 # TB-033 — Public surface audit
 
-**Status:** not started  
-**Your call:** _(unset — talk first)_
+**Status:** done — audited 2026-06-11  
+**Your call:** Do it (walkthrough complete; action items below)
 
 ---
 
@@ -32,9 +32,54 @@
 
 | | |
 |---|---|
-| **Decision** | |
-| **Notes** | |
-| **Date** | |
+| **Decision** | Do it — audit complete; fixes tracked below |
+| **Notes** | Obsidian locked down in TB-005. Auth gaps → TB-006 (other session). |
+| **Date** | 2026-06-11 |
+
+---
+
+## Audit results (2026-06-11)
+
+Sites **without** `internal_only` — reachable from the public internet (Cloudflare → Caddy):
+
+### Intentionally public ✓
+
+| Site | Purpose |
+|------|---------|
+| foundry.ginnoir.com, foundry2.ginnoir.com | Foundry VTT for players |
+| 5etools.ginnoir.com, pf2e.ginnoir.com | Tabletop reference sites |
+| files.ginnoir.com | ownCloud (Authentik on admin UI) |
+| ffttsystems.ginnoir.com | Static site |
+| requests.ginnoir.com | Overseerr for friends |
+| ntfy.ginnoir.com | Push notifications (native auth) |
+| freshrss.ginnoir.com | RSS reader (HTTP auth via Authentik) |
+| resume.ginnoir.com, j-costa.com | Portfolio |
+| storage.j-costa.com | Resume PDF/object storage (public by design) |
+| fam.ginnoir.com | Family app (Authentik OIDC) |
+| auth.ginnoir.com | Authentik |
+| dev.ginnoir.com | External LAN host (192.168.1.74) — DNS public but host isn't on valhalla |
+
+### Public but gated (Authentik forward_auth or native OIDC) — OK for now
+
+| Site | Gate |
+|------|------|
+| sonarr–stash, qbittorrent, deluge, … | `internal_only` + Authentik |
+| uptime.ginnoir.com, backup.ginnoir.com | Authentik |
+| code.ginnoir.com, registry-ui, dbx, vault, plane.ginnoir.com | Authentik |
+| portainer.ginnoir.com | Authentik on UI; webhook POST bypass |
+
+### Flagged — review / fix
+
+| Site | Issue | Action |
+|------|-------|--------|
+| ~~**minio.ginnoir.com**~~ | ~~Public console~~ | **Fixed 2026-06-11** — `internal_only` |
+| ~~**homarr.ginnoir.com**~~ | ~~Public, no auth~~ | **Fixed 2026-06-11** — `internal_only` |
+| ~~**docs.ginnoir.com**~~ | ~~Public BookStack~~ | **Fixed 2026-06-11** — `internal_only` |
+| **gitea.ginnoir.com** | UI reachable; api/git bypass by design | OK if Gitea login is enough; optional Authentik — **TB-006** |
+
+### Correctly internal-only ✓
+
+obsidian, roms, romhacks, romhacks-files, registry.ginnoir.com, router.ginnoir.com, jd.ginnoir.com (added TB-002), all *arr admin UIs.
 
 ---
 
@@ -53,7 +98,7 @@ Caddyfile review only
 
 ### Done when
 
-- [ ] Every public site has your yes/no
-- [ ] Action items linked to other TBs
+- [x] Every public site has your yes/no
+- [x] Action items linked to other TBs
 
 </details>