counterweight
d208783fbf
Navidrome 0.64.0 on music-box (nodito VM 8200, 1 core / 1 GB / 50 GB), public at music.contrapeso.xyz. A single Go binary with a SQLite database; the only external dependency is ffmpeg for transcoding. Plus beets, the CLI that fixes tags before Navidrome ever indexes them. ── Exposed without basic auth, on purpose ───────────────────────────────── Navidrome speaks two protocols on one port: its web UI, and the Subsonic API (/rest/*) that every mobile client actually uses. A Subsonic client authenticates with ?u=&t=md5(password+salt)&s= in the query string and has nowhere to carry a second credential, so Basic Auth in front of the site is invisible to most of them. The choice is a proxy credential or a working phone. Same call this estate already made for monerod's restricted RPC, for the same reason: proxied bare so Feather can reach it, with the service's own auth doing the authenticating. The cost is stated rather than glossed: the login page and the whole /rest/* surface are reachable by anyone who finds the hostname, and Navidrome has no rate limiting and no 2FA. A fail2ban jail on vipy reads a per-vhost Caddy access log and catches WEB UI brute force, where a bad login returns 401. It very likely does NOT catch Subsonic brute force, because that protocol answers a bad password with HTTP 200 and puts the failure in the body - which Caddy never sees. Nor can it be fixed on the music box: the request arrives from vipy over the tailnet, so the only address fail2ban could ban there is vipy's, which would take down every service behind the edge. Banning has to happen at the edge; the edge cannot see the failure. So /rest/* is protected by password strength alone, and the README carries a one-line curl to re-check that after every upgrade. ── Passwords are stored reversibly, and cannot not be ───────────────────── The Subsonic API requires the server to compute md5(password+salt) per request, so Navidrome cannot hash passwords one-way. It encrypts them at rest with PasswordEncryptionKey instead. Two real consequences, both in the README: root on that box means every Navidrome password in plaintext, so the password must be unique to this service; and changing the key invalidates every stored password, so it is set before the first account and left alone. ── beets is not a service, deliberately ─────────────────────────────────── `beet import` is interactive and it MOVES AND RENAMES FILES. A timer that reorganises a music library unattended is a way to lose one. Installed and configured, run by hand. /srv/music is counterweight:navidrome mode 2750 and the setgid bit is load-bearing: without it beets' files land in the curator's own group, Navidrome cannot read them, and the symptom is an EMPTY LIBRARY rather than a permission error. ReplayGain and lyrics are auto: no - on one core they turn a two-minute import into a twenty-minute one. ── Monitoring ───────────────────────────────────────────────────────────── Host liveness and disk (400), the systemd unit (401), a probe that fetches /app/ and greps it (403), and public reachability plus cert expiry (402). /app/ was chosen by testing all three candidates against 0.64.0: /ping returns a bare "." and proves only that something listens; /rest/ping.view identifies the server but logs two warnings per call, ~576 a day; /app/ returns <title>Navidrome</title> and logs nothing. 402 asserts 200 on /app/ and not on "/", because "/" answers 302 - checked live rather than assumed. ── Also ─────────────────────────────────────────────────────────────────── The headscale ACL grants tag:prd-vipy exactly tag:music-box:4533. Without a rule the node is invisible rather than unreachable, which surfaces as a Caddy 502 "no such host". inventory lan_ip was read off nodito's ARP table for the VM's own MAC, not guessed - and .149 had belonged to another machine, whose stale host key made SSH refuse the connection. That is the designed behaviour, not a fault. 50 GB is the LIBRARY ceiling, not just the OS: /srv/music is on the root disk, so roughly 300-450 albums in FLAC. 1 GB is fine for serving and tight for the initial scan, which is the memory peak. No backups, deliberately. The music files would swamp the age-encrypted nightly path, and navidrome.db is a rebuildable index. What is NOT rebuildable is playlists, play counts, ratings and accounts - there are none today, which is what makes the trade fair, and the README names this as the decision to revisit if that changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
80 lines
3.6 KiB
YAML
80 lines
3.6 KiB
YAML
new_user: counterweight
|
|
ssh_port: 22
|
|
allow_ssh_from: "any"
|
|
root_domain: contrapeso.xyz
|
|
|
|
# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the
|
|
# playbooks are kept deliberately — the check logic is meant to be rewired to
|
|
# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.
|
|
|
|
# age recipient for all backup artefacts
|
|
age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr9fsza"
|
|
|
|
# Public key small-backups-box pulls with
|
|
# Authorised on each source host for an unprivileged, dedicated user only
|
|
backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Subdomains. Global because the edge host proxies for services that live on
|
|
# other machines, so no single inventory group covers the readers. Combine with
|
|
# root_domain above to build an FQDN.
|
|
#
|
|
# Moved here from services_config.yml, which 30 plays had to remember to name in
|
|
# vars_files: - a file everyone must opt into is a file someone will forget.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
subdomains:
|
|
# Monitoring
|
|
gatus: status
|
|
|
|
# VPN infrastructure (spacey)
|
|
headscale: headscale
|
|
|
|
# Core services (vipy)
|
|
vaultwarden: vault
|
|
forgejo: forgejo
|
|
lnbits: wallet
|
|
|
|
# Secondary services (vipy)
|
|
ntfy_emergency_app: avisame
|
|
personal_blog: pablohere
|
|
|
|
# Memos (memos-box)
|
|
memos: memos
|
|
|
|
# Mempool block explorer (mempool-box, proxied via vipy)
|
|
mempool: mempool
|
|
|
|
# DATUM Gateway dashboard (knots-box, proxied via vipy)
|
|
datum_gateway: datum
|
|
|
|
# Monero restricted RPC (monerod-box, proxied via vipy). Not a dashboard:
|
|
# this is the JSON-RPC endpoint Feather points at. Caddy terminates TLS and
|
|
# monerod's own Digest auth does the authentication.
|
|
monero: monero
|
|
|
|
# Monero block explorer (monerod-box, proxied via vipy). Fully public and
|
|
# unauthenticated, like any block explorer - the data is the public chain.
|
|
monero_explorer: exmrplore
|
|
|
|
# Navidrome music server (music-box, proxied via vipy). No basic auth:
|
|
# Navidrome has its own login, and the Subsonic API the mobile clients speak
|
|
# has nowhere to carry a second credential. Same call made for monero above.
|
|
music: music
|
|
|
|
# Read by plays across several groups, so global rather than group_vars/<group>.
|
|
headscale_namespace: counter-net
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Domains whose registration expiry is monitored (infra/402_public_monitoring).
|
|
#
|
|
# Registration renewal is a manual act at the registrar, and losing a domain is
|
|
# not recoverable in the way losing a host is - so these are checked daily and
|
|
# alarm with two weeks of runway.
|
|
#
|
|
# root_domain is the estate's own domain; the rest are domains we own that are
|
|
# served from it or from a host in the inventory.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
monitored_domains:
|
|
- "{{ root_domain }}"
|
|
- arbret.com
|