ginnoir
51acb44322
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
105 lines
3.4 KiB
Markdown
105 lines
3.4 KiB
Markdown
# TB-033 — Public surface audit
|
||
|
||
**Status:** done — audited 2026-06-11
|
||
**Your call:** Do it (walkthrough complete; action items below)
|
||
|
||
---
|
||
|
||
## Talk first
|
||
|
||
> **Stop.** Don't read Reference until we've talked.
|
||
> In chat, say **"let's do TB-033"** or **"public surface audit"**.
|
||
|
||
**In one sentence:** A short conversation + checklist: what's reachable from the internet, and should it be?
|
||
|
||
**Why it came up:** Some things are public on purpose (Foundry, famapp); some might surprise you (Obsidian).
|
||
|
||
### Questions
|
||
|
||
1. Want to walk through the list together in chat instead of reading a table?
|
||
2. Any service you *know* should be public that we'd flag as wrong?
|
||
|
||
### Your options
|
||
|
||
| Option | Meaning |
|
||
|--------|---------|
|
||
| **Do it** | We're doing this — I'll implement or walk you through it |
|
||
| **Later** | Keep on the list, not now |
|
||
| **Drop** | Remove from plan — totally fine |
|
||
| **Tweak** | Change scope; tell me how |
|
||
|
||
### What we decided
|
||
|
||
| | |
|
||
|---|---|
|
||
| **Decision** | Do it — audit complete; fixes tracked below |
|
||
| **Notes** | Obsidian locked down in TB-005. Auth gaps → TB-006 (other session). |
|
||
| **Date** | 2026-06-11 |
|
||
|
||
---
|
||
|
||
## Audit results (2026-06-11)
|
||
|
||
Sites **without** `internal_only` — reachable from the public internet (Cloudflare → Caddy):
|
||
|
||
### Intentionally public ✓
|
||
|
||
| Site | Purpose |
|
||
|------|---------|
|
||
| foundry.ginnoir.com, foundry2.ginnoir.com | Foundry VTT for players |
|
||
| 5etools.ginnoir.com, pf2e.ginnoir.com | Tabletop reference sites |
|
||
| files.ginnoir.com | ownCloud (Authentik on admin UI) |
|
||
| ffttsystems.ginnoir.com | Static site |
|
||
| requests.ginnoir.com | Overseerr for friends |
|
||
| ntfy.ginnoir.com | Push notifications (native auth) |
|
||
| freshrss.ginnoir.com | RSS reader (HTTP auth via Authentik) |
|
||
| resume.ginnoir.com, j-costa.com | Portfolio |
|
||
| storage.j-costa.com | Resume PDF/object storage (public by design) |
|
||
| fam.ginnoir.com | Family app (Authentik OIDC) |
|
||
| auth.ginnoir.com | Authentik |
|
||
| dev.ginnoir.com | External LAN host (192.168.1.74) — DNS public but host isn't on valhalla |
|
||
|
||
### Public but gated (Authentik forward_auth or native OIDC) — OK for now
|
||
|
||
| Site | Gate |
|
||
|------|------|
|
||
| sonarr–stash, qbittorrent, deluge, … | `internal_only` + Authentik |
|
||
| uptime.ginnoir.com, backup.ginnoir.com | Authentik |
|
||
| code.ginnoir.com, registry-ui, dbx, vault, plane.ginnoir.com | Authentik |
|
||
| portainer.ginnoir.com | Authentik on UI; webhook POST bypass |
|
||
|
||
### Flagged — review / fix
|
||
|
||
| Site | Issue | Action |
|
||
|------|-------|--------|
|
||
| ~~**minio.ginnoir.com**~~ | ~~Public console~~ | **Fixed 2026-06-11** — `internal_only` |
|
||
| ~~**homarr.ginnoir.com**~~ | ~~Public, no auth~~ | **Fixed 2026-06-11** — `internal_only` |
|
||
| ~~**docs.ginnoir.com**~~ | ~~Public BookStack~~ | **Fixed 2026-06-11** — `internal_only` |
|
||
| **gitea.ginnoir.com** | UI reachable; api/git bypass by design | OK if Gitea login is enough; optional Authentik — **TB-006** |
|
||
|
||
### Correctly internal-only ✓
|
||
|
||
obsidian, roms, romhacks, romhacks-files, registry.ginnoir.com, router.ginnoir.com, jd.ginnoir.com (added TB-002), all *arr admin UIs.
|
||
|
||
---
|
||
|
||
<details>
|
||
<summary>Reference (only open if we're doing it)</summary>
|
||
|
||
### Stack / files
|
||
|
||
Caddyfile review only
|
||
|
||
### If we do it — rough steps
|
||
|
||
1. Walk each public domain in conversation
|
||
2. Mark: keep public / lock down / drop
|
||
3. Save decisions here and in TB-005/TB-006 as needed
|
||
|
||
### Done when
|
||
|
||
- [x] Every public site has your yes/no
|
||
- [x] Action items linked to other TBs
|
||
|
||
</details>
|