From 80b0fc69049e8113f489a1bb35c4bfe35e9e8291 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Wed, 10 Jun 2026 22:19:50 -0500
Subject: [PATCH] Restrict Obsidian LiveSync to LAN and tailnet only.

Closes TB-005: obsidian.ginnoir.com was publicly reachable; sync clients use tailnet.
---
 Caddyfile                                              |  3 ++-
 bookmarks-domains.html                                 |  2 +-
 .../tasks/TB-005-obsidian-hardening.md                 | 10 +++++-----
 stacks/notes/docker-compose.yml                        |  2 +-
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/Caddyfile b/Caddyfile
index b96f9b8..56fe1c2 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -306,8 +306,9 @@ plane.ginnoir.com {
 }
 
 # =============================================================
-# NOTES / PKM — public (obsidian-livesync syncs from any device)
+# NOTES / PKM — internal only (LiveSync over LAN or tailnet)
 # =============================================================
 obsidian.ginnoir.com {
+	import internal_only
 	reverse_proxy couchdb:5984
 }
diff --git a/bookmarks-domains.html b/bookmarks-domains.html
index 3a4b9e9..6b3efce 100644
--- a/bookmarks-domains.html
+++ b/bookmarks-domains.html
@@ -100,7 +100,7 @@
             <DT><A HREF="https://plane.ginnoir.com">plane</A>
         </DL><p>
 
-        <DT><H3>NOTES / PKM — public (obsidian-livesync syncs from any device) (public)</H3>
+        <DT><H3>NOTES / PKM — internal only (LiveSync over LAN or tailnet) (internal)</H3>
         <DL><p>
             <DT><A HREF="https://obsidian.ginnoir.com">obsidian</A>
         </DL><p>
diff --git a/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md b/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md
index be69a42..9a3eb0b 100644
--- a/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md
+++ b/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md
@@ -1,7 +1,7 @@
 # TB-005 — Obsidian / CouchDB hardening
 
-**Status:** not started  
-**Your call:** _(unset — talk first)_
+**Status:** done (pending deploy)  
+**Your call:** Do it — LAN/tailnet only via `internal_only`
 
 ---
 
@@ -33,9 +33,9 @@
 
 | | |
 |---|---|
-| **Decision** | |
-| **Notes** | |
-| **Date** | |
+| **Decision** | Do it — `internal_only` (LAN + tailnet); no public access |
+| **Notes** | All LiveSync clients on tailnet; Authentik not needed |
+| **Date** | 2026-06-10 |
 
 ---
 
diff --git a/stacks/notes/docker-compose.yml b/stacks/notes/docker-compose.yml
index 843799a..2a14e89 100644
--- a/stacks/notes/docker-compose.yml
+++ b/stacks/notes/docker-compose.yml
@@ -1,7 +1,7 @@
 # notes stack — personal knowledge base / PKM backbone.
 #
 # CouchDB powers obsidian-livesync for real-time Obsidian vault sync
-# across all devices. Vault data lives at /config/couchdb/data on SSD.
+# across LAN/tailnet devices. Vault data lives at /config/couchdb/data on SSD.
 #
 # POST-DEPLOY (one-time setup):
 #   1. Open https://obsidian.ginnoir.com/_utils and sign in as admin.