chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned). Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md (nodes/ports/known-issues), agent definitions. Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief, tls-options and security-headers Traefik config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 11:19:21 -05:00
parent 47ac49a039
commit 27f6d95bf6
34 changed files with 8589 additions and 322 deletions
@@ -0,0 +1,60 @@
+http:
+  middlewares:
+    security-headers:
+      headers:
+        # HSTS - force browsers to use HTTPS for 1 year, include subdomains
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        # Prevent MIME-type sniffing
+        contentTypeNosniff: true
+        # Block rendering in iframes from other origins
+        frameDeny: true
+        # Referrer policy - send origin only on cross-origin requests
+        referrerPolicy: "strict-origin-when-cross-origin"
+        # Permissions policy - restrict browser features
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        # Prevent browsers from caching sensitive responses
+        browserXssFilter: true
+        # Remove server identity header
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # Variant that allows microphone (for VoiceCoach)
+    security-headers-allow-mic:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(self), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # BasicAuth for sensitive services (Guacamole)
+    solo-basicauth:
+      basicAuth:
+        users:
+          - "glyptic:$2y$05$6AcmRIjMX6YrxY3fACeDhui4ghBGZtjmiPHbzWDb.qZ.8Fdip4GM."
+        realm: "Restricted"
+
+    # Variant that allows framing (for Guacamole, Home Assistant embeds)
+    security-headers-allow-frames:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: false
+        customFrameOptionsValue: "SAMEORIGIN"
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""