jimmy/nas-tools
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity
95 Commits 15 Branches 0 Tags
607d09935cf73036264616f4b526f9d23a4ad5a7
Commit Graph

4 Commits

Author SHA1 Message Date
Gan, Jimmy cdd364e645 security: bind service ports to localhost only 
Bind navidrome, n8n, immich, openclaw, gitea web ports to 127.0.0.1
to prevent direct LAN access bypassing Caddy/Authelia.

Tailscale userspace networking on Synology proxies through localhost,
so VPS Caddy access via Tailscale IP continues to work.

Gitea SSH port (2222) remains on all interfaces for external git push.
 2026-02-28 22:47:36 +08:00
Gan, Jimmy 3fd045aacb feat: security hardening and HTTPS/SSO infrastructure configs
Deploy Dashboard / deploy (push) Successful in 1m28s
Details 
- Narrow trusted proxies, remove overly broad 10.0.0.0/8
- Fail closed on missing SSH known_hosts in terminal proxy
- Add Navidrome reverse proxy headers for Authelia SSO
- Add Gitea docker-compose definition
- Add Caddy configs for NAS and VPS edge proxies
- Add dnsmasq split-horizon DNS config
- Add security execution plan document
 2026-02-28 22:25:39 +08:00
Gan, Jimmy 64ecd99dc7 Add OpenClaw, backup automation, health checks, Telegram notifications 
Phase 6: OpenClaw docker-compose (port 3100) with health check
Phase 9: Enhanced backup.sh with full DB/config coverage + Telegram alerts
Phase 10: Health checks on all compose files, /api/system/notify endpoint
 2026-02-19 21:40:34 +08:00
Gan, Jimmy ae1b88732d Add Navidrome docker-compose for music streaming 2026-02-19 02:02:54 +08:00