5a95010f35
fix: route watchtower SMTP through SSH tunnel to bypass GFW
...
- Switch to shoutrrr notification URL format
- Use extra_hosts to resolve smtp.gmail.com to local tunnel (192.168.31.222:1587)
- Add URL-encoded SMTP credentials for shoutrrr URL compatibility
- SSH tunnel: NAS:1587 -> server2 -> smtp.gmail.com:587
2026-03-01 01:07:47 +08:00
4b32929dcc
feat: watchtower tracking, dev environment, security logs page
...
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 1m54s
- watchtower: docker-compose with label filtering, email notifications
- watchtower labels on navidrome, openclaw, immich services
- dev env: docker-compose.dev.yml (port 4001), deploy-dev.yml CI workflow
- dev.nas.jimmygan.com Caddy site block with Authelia forward_auth
- security page: backend router parsing Authelia/Caddy container logs
- security page: frontend with stats cards, timeline, top IPs, event log
- wired security route into App.svelte and Sidebar
2026-03-01 00:40:14 +08:00
44aafe7ea5
fix: use 127.0.0.1 instead of localhost in NAS Caddyfile
...
Prevents Caddy from trying IPv6 [::1] which fails when services
are bound to IPv4 127.0.0.1 only.
2026-02-28 23:11:28 +08:00
607d09935c
fix: use wildcard DNS for all *.jimmygan.com subdomains
2026-02-28 23:06:54 +08:00
cdd364e645
security: bind service ports to localhost only
...
Bind navidrome, n8n, immich, openclaw, gitea web ports to 127.0.0.1
to prevent direct LAN access bypassing Caddy/Authelia.
Tailscale userspace networking on Synology proxies through localhost,
so VPS Caddy access via Tailscale IP continues to work.
Gitea SSH port (2222) remains on all interfaces for external git push.
2026-02-28 22:47:36 +08:00
3fd045aacb
feat: security hardening and HTTPS/SSO infrastructure configs
...
Deploy Dashboard / deploy (push) Successful in 1m28s
- Narrow trusted proxies, remove overly broad 10.0.0.0/8
- Fail closed on missing SSH known_hosts in terminal proxy
- Add Navidrome reverse proxy headers for Authelia SSO
- Add Gitea docker-compose definition
- Add Caddy configs for NAS and VPS edge proxies
- Add dnsmasq split-horizon DNS config
- Add security execution plan document
2026-02-28 22:25:39 +08:00
8c30fb7a3a
chore: remove hardcoded secrets from configuration template
...
Replace real secrets in tmp_remote/configuration.yml with __ROTATE_*__
placeholders. All leaked values have already been rotated.
Also add .claude/, .codex/, and security_artifacts/ to .gitignore.
2026-02-28 22:22:23 +08:00
1c562e65b7
feat: migrate all services to HTTPS subdomains with Authelia SSO
...
Deploy Dashboard / deploy (push) Successful in 2m36s
All dashboard services now route through NAS Caddy with HTTPS and SSO:
- media.jimmygan.com:8443 → Jellyfin
- photos.jimmygan.com:8443 → Immich
- books.jimmygan.com:8443 → Audiobookshelf
- git.jimmygan.com:8443 → Gitea
- pdf.jimmygan.com:8443 → Stirling PDF
- vault.jimmygan.com:8443 → Vaultwarden
- speed.jimmygan.com:8443 → Speedtest (no auth)
Benefits:
- HTTPS for all services (browser secure context)
- Single sign-on via Authelia (except Speedtest)
- Future-ready for public exposure (just add VPS routes)
- Services remain Tailscale/LAN-only (no public DNS yet)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-02-28 01:23:54 +08:00
a0354c335b
fix: trust docker gateway IP for reverse proxy auth
Deploy Dashboard / deploy (push) Successful in 1m35s
2026-02-27 23:48:34 +08:00
3888a57642
chore: secure dashboard proxy endpoint and decouple lan checks
Deploy Dashboard / deploy (push) Successful in 1m48s
2026-02-27 23:41:36 +08:00
29a9e9d881
feat: integrate Authelia SSO and update LLDAP routing
Deploy Dashboard / deploy (push) Successful in 16m20s
2026-02-27 23:04:57 +08:00
c676c84bc1
feat: add chat group daily summarizer
...
Deploy Dashboard / deploy (push) Failing after 38s
- Telegram collector (Telethon MTProto) with checkpoint-based message fetching
- Claude API summarization via proxy (haiku model)
- Dashboard page with date picker, markdown summary, raw message drill-down
- Separate container lifecycle from dashboard for stable Telethon sessions
- Shared SQLite DB mounted read-only into dashboard
2026-02-27 02:51:52 +08:00
7f94013bf9
feat: add Caddy VPS terminal connection
Deploy Dashboard / deploy (push) Successful in 1m44s
2026-02-27 00:26:01 +08:00
394a1aa367
security: harden dashboard (SSH keys, auth, uploads, CORS, non-root)
...
Remove SSH private keys from git, add SECRET_KEY validation, move WS
auth from query string to first message, add session limits/idle timeout,
PBKDF2 Fernet key, refresh token rotation, TOTP replay protection,
file upload size limit + filename sanitization, symlink safety check,
restrict CORS methods, IP-gate OpenClaw token, run container as non-root,
rate-limit refresh/passkey endpoints, sanitize Gitea path params.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-02-26 17:22:25 +08:00
d25b3f0785
fix: use flex layout in voice mode to prevent page scroll competing with xterm
2026-02-26 16:57:29 +08:00
643d576816
fix: filter terminal UI chrome (shortcuts, prompts, keybindings) from TTS
2026-02-26 16:40:34 +08:00
1b06aaa5c7
fix: compact voice mode bottom sheet, hide title, inline mic+transcript
2026-02-26 16:25:35 +08:00
3d6fb06439
feat: add TTS voice picker to voice mode bottom sheet
2026-02-26 16:22:16 +08:00
ee6c404122
fix: TTS reads output in auto mode (don't skip when listening)
2026-02-26 16:12:36 +08:00
70c716fd19
feat: voice mode bottom sheet with hold/tap/auto talk modes
2026-02-26 16:03:43 +08:00
47ab062edd
fix: type STT text char-by-char, increase TTS debounce to 2s
2026-02-26 15:50:17 +08:00
af74552a01
fix: iOS TTS unlock on user gesture, use \r for terminal Enter
2026-02-26 15:45:27 +08:00
70d3be71b9
fix: voice controls reactivity, disable mic on unsupported browsers
2026-02-26 15:40:15 +08:00
9c5dbcdb37
feat: add voice mode (STT/TTS) to terminal page
2026-02-26 15:35:43 +08:00
cbb4f8286b
Add n8n docker-compose and include in backup
2026-02-26 14:58:42 +08:00
fc2a5aaa9c
feat: n8n via HTTPS subdomain on NAS Caddy
2026-02-26 14:46:29 +08:00
ee80084edb
feat: add n8n to dashboard sidebar
2026-02-26 13:35:12 +08:00
c4ebfb6432
feat: smart LAN detection for sidebar links via X-Forwarded-For and router probe
2026-02-26 03:34:47 +08:00
b03b20aee6
feat: terminal tabs with on-demand connections and Claude Dev host
2026-02-26 02:59:25 +08:00
332696689a
fix: support port 8443 origin for WebAuthn passkeys and CORS
2026-02-26 02:00:29 +08:00
9305ce05cd
feat: update Navidrome remoteHref to use NAS Caddy port 8443
2026-02-26 01:56:38 +08:00
jimmy
f384a220c7
revert test commit
2026-02-25 13:46:29 +00:00
jimmy
c473552d3c
test: verify Claude Code on NAS can build+deploy
2026-02-25 13:40:11 +00:00
f1e802e01b
CI: add build step to deploy workflow
...
- Clone from local Gitea instead of actions/checkout
- Build with legacy builder (DOCKER_BUILDKIT=0) for Docker mirror support
- Use npm China mirror (registry.npmmirror.com) in Dockerfile
- Combined npm install+build in single RUN step
- Removed stale proxy env vars
2026-02-25 21:14:00 +08:00
09592d9ded
Add CLAUDE.md for shared project context
2026-02-25 02:09:04 +08:00
08f3065e24
Fix sidebar links: use Tailscale IP when accessed via public domain
2026-02-25 00:22:54 +08:00
b813597393
Reorganize sidebar: Main/Media/Tools categories, Settings to bottom
2026-02-25 00:16:49 +08:00
2498876c78
Fix sidebar: add overflow scroll for small screens
2026-02-25 00:09:49 +08:00
6c3bb26c3d
Clean up: remove stale scripts/docs, fix debug prints, update PLAN.md
2026-02-24 10:14:48 +08:00
98975f45c2
Update LAN IP to 192.168.31.221 for Sidebar links
2026-02-24 01:46:07 +08:00
444566f4b4
Phase 9: backup script + Telegram alerts; add Phase 13 placeholder; fix OpenClaw ANTHROPIC_BASE_URL
2026-02-22 20:36:12 +08:00
25dbe7ad1d
Add Audiobookshelf, Stirling PDF, Vaultwarden to sidebar; update PLAN.md
2026-02-22 20:13:39 +08:00
549af23c14
Fix storage display: deduplicate volumes by device
2026-02-22 18:37:49 +08:00
87fdabcd50
Fix OpenClaw: auto-include gateway token in dashboard link
2026-02-22 18:30:34 +08:00
8797231f53
Add container health status, multi-volume storage, auto-refresh Overview
2026-02-22 17:11:17 +08:00
ae98811c23
Smart LAN routing for Navidrome sidebar link
2026-02-22 16:59:33 +08:00
2da9d47bdd
Fix passkey login on non-HTTPS connections
2026-02-22 16:52:27 +08:00
3c186989b1
Smart LAN detection for sidebar service links
2026-02-22 16:45:31 +08:00
57f6780d7c
Replace Emby with Jellyfin in sidebar
2026-02-22 16:28:00 +08:00
eadd44eee5
Fix Settings page dark mode styling
2026-02-22 15:03:36 +08:00
Gan, Jimmy
jimmy