jeremy
0e4b2f7d1a
Backs the Obsidian 'Second Brain' vault (private repo: git.hobbs.farm/jeremy/
second-brain) with self-hosted multi-device sync. LAN-only for now; no public
Traefik route yet.
- couchdb:3.4 pinned, Watchtower disabled, mem_limit 1g.
- Data on LOCAL disk (/var/lib/couchdb) -- CouchDB file locking breaks over
NFSv3, same class as guacamole-db and semaphore-db.
- local.ini mounted READ-WRITE, deliberately: CouchDB 3.x writes runtime config
back into the last-loaded ini, and with :ro it exits 1 and logs NOTHING --
a silent crash-loop that is very hard to diagnose.
- CORS allows app://obsidian.md and capacitor://localhost (LiveSync desktop +
mobile origins); a wildcard origin is not allowed alongside credentials.
- require_valid_user everywhere EXCEPT /_up, so the blackbox probe can health
check it without credentials. Anonymous callers get 401 on all data.
- Admin credentials in Vaultwarden ('CouchDB - Obsidian LiveSync'); .env is
gitignored, .env.example carries a placeholder.
Prometheus probe added (probe_success=1). Vault database: 'secondbrain'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
31 lines
972 B
INI
31 lines
972 B
INI
; CouchDB config for Obsidian LiveSync.
|
|
; Obsidian talks to CouchDB from an app:// origin, so CORS must allow it explicitly --
|
|
; a wildcard origin is not permitted alongside credentials.
|
|
|
|
[couchdb]
|
|
single_node = true
|
|
max_document_size = 50000000
|
|
|
|
[chttpd]
|
|
require_valid_user = true
|
|
; ...but leave /_up open, so the Prometheus blackbox probe can health-check it
|
|
; without credentials. Everything else still returns 401 to anonymous callers.
|
|
require_valid_user_except_for_up = true
|
|
max_http_request_size = 4294967296
|
|
bind_address = 0.0.0.0
|
|
|
|
[chttpd_auth]
|
|
require_valid_user = true
|
|
authentication_redirect = /_utils/session.html
|
|
|
|
[httpd]
|
|
WWW-Authenticate = Basic realm="couchdb"
|
|
enable_cors = true
|
|
|
|
[cors]
|
|
credentials = true
|
|
; Obsidian desktop is app://obsidian.md; mobile uses capacitor://localhost.
|
|
origins = app://obsidian.md,capacitor://localhost,http://localhost
|
|
methods = GET,PUT,POST,HEAD,DELETE
|
|
headers = accept,authorization,content-type,origin,referer,x-csrf-token
|