Restrict Obsidian LiveSync to LAN and tailnet only.

Closes TB-005: obsidian.ginnoir.com was publicly reachable; sync clients use tailnet.

Caddyfile

@@ -306,8 +306,9 @@ plane.ginnoir.com {
 }
 
 # =============================================================
-# NOTES / PKM — public (obsidian-livesync syncs from any device)
+# NOTES / PKM — internal only (LiveSync over LAN or tailnet)
 # =============================================================
 obsidian.ginnoir.com {
+	import internal_only
 	reverse_proxy couchdb:5984
 }

bookmarks-domains.html

@@ -100,7 +100,7 @@
             <DT><A HREF="https://plane.ginnoir.com">plane</A>
         </DL><p>
 
-        <DT><H3>NOTES / PKM — public (obsidian-livesync syncs from any device) (public)</H3>
+        <DT><H3>NOTES / PKM — internal only (LiveSync over LAN or tailnet) (internal)</H3>
         <DL><p>
             <DT><A HREF="https://obsidian.ginnoir.com">obsidian</A>
         </DL><p>

plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md

@@ -1,7 +1,7 @@
 # TB-005 — Obsidian / CouchDB hardening
 
-**Status:** not started  
-**Your call:** _(unset — talk first)_
+**Status:** done (pending deploy)  
+**Your call:** Do it — LAN/tailnet only via `internal_only`
 
 ---
 
@@ -33,9 +33,9 @@
 
 | | |
 |---|---|
-| **Decision** | |
-| **Notes** | |
-| **Date** | |
+| **Decision** | Do it — `internal_only` (LAN + tailnet); no public access |
+| **Notes** | All LiveSync clients on tailnet; Authentik not needed |
+| **Date** | 2026-06-10 |
 
 ---
 

stacks/notes/docker-compose.yml

@@ -1,7 +1,7 @@
 # notes stack — personal knowledge base / PKM backbone.
 #
 # CouchDB powers obsidian-livesync for real-time Obsidian vault sync
-# across all devices. Vault data lives at /config/couchdb/data on SSD.
+# across LAN/tailnet devices. Vault data lives at /config/couchdb/data on SSD.
 #
 # POST-DEPLOY (one-time setup):
 #   1. Open https://obsidian.ginnoir.com/_utils and sign in as admin.