chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/traefik/dynamic/gitea.yml

@@ -4,6 +4,8 @@ http:
       rule: "Host(`git.hobbs.farm`)"
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       service: gitea
       tls:
         certResolver: letsencrypt

stacks/traefik/dynamic/openwebui.yml

@@ -1,26 +0,0 @@
-http:
-  routers:
-    openwebui:
-      rule: "Host(`open.hobbs.farm`)"
-      entryPoints:
-        - websecure
-      service: openwebui
-      tls:
-        certResolver: letsencrypt
-    openwebui-http:
-      rule: "Host(`open.hobbs.farm`)"
-      entryPoints:
-        - web
-      middlewares:
-        - openwebui-https-redirect
-      service: openwebui
-  middlewares:
-    openwebui-https-redirect:
-      redirectScheme:
-        scheme: https
-        permanent: true
-  services:
-    openwebui:
-      loadBalancer:
-        servers:
-          - url: "http://192.168.86.192:3010"

stacks/traefik/dynamic/security-headers.yml

@@ -0,0 +1,60 @@
+http:
+  middlewares:
+    security-headers:
+      headers:
+        # HSTS - force browsers to use HTTPS for 1 year, include subdomains
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        # Prevent MIME-type sniffing
+        contentTypeNosniff: true
+        # Block rendering in iframes from other origins
+        frameDeny: true
+        # Referrer policy - send origin only on cross-origin requests
+        referrerPolicy: "strict-origin-when-cross-origin"
+        # Permissions policy - restrict browser features
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        # Prevent browsers from caching sensitive responses
+        browserXssFilter: true
+        # Remove server identity header
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # Variant that allows microphone (for VoiceCoach)
+    security-headers-allow-mic:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(self), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # BasicAuth for sensitive services (Guacamole)
+    solo-basicauth:
+      basicAuth:
+        users:
+          - "glyptic:$2y$05$6AcmRIjMX6YrxY3fACeDhui4ghBGZtjmiPHbzWDb.qZ.8Fdip4GM."
+        realm: "Restricted"
+
+    # Variant that allows framing (for Guacamole, Home Assistant embeds)
+    security-headers-allow-frames:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: false
+        customFrameOptionsValue: "SAMEORIGIN"
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""

stacks/traefik/dynamic/tls-options.yml

@@ -0,0 +1,18 @@
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      cipherSuites:
+        # TLS 1.3 ciphers are always enabled and not configurable
+        # These are the strong TLS 1.2 ciphers
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+      curvePreferences:
+        - X25519
+        - CurveP256
+        - CurveP384
+      sniStrict: true

stacks/traefik/dynamic/vaultwarden.yml

@@ -4,6 +4,8 @@ http:
       rule: "Host(`vault.hobbs.farm`)"
       entryPoints:
         - websecure
+      middlewares:
+        - security-headers
       service: vault
       tls:
         certResolver: letsencrypt