Restrict Obsidian LiveSync to LAN and tailnet only.

Closes TB-005: obsidian.ginnoir.com was publicly reachable; sync clients use tailnet.
2026-06-10 22:19:50 -05:00
parent d5a54b24cc
commit 80b0fc6904
4 changed files with 9 additions and 8 deletions
@@ -1,7 +1,7 @@
 # TB-005 — Obsidian / CouchDB hardening

-**Status:** not started  
-**Your call:** _(unset — talk first)_
+**Status:** done (pending deploy)  
+**Your call:** Do it — LAN/tailnet only via `internal_only`

 ---

@@ -33,9 +33,9 @@

 | | |
 |---|---|
-| **Decision** | |
-| **Notes** | |
-| **Date** | |
+| **Decision** | Do it — `internal_only` (LAN + tailnet); no public access |
+| **Notes** | All LiveSync clients on tailnet; Authentik not needed |
+| **Date** | 2026-06-10 |

 ---