hetzner-infra/.gitignore, branch master

hetzner-admin: stop/start individual services, shown as STOPPED on status page

2026-10-31T13:45:58Z

- run-command.sh: services / stop / start for app and infra stacks (not caddy, hetzner-admin, status). Stopped names go to status/stopped.txt (gitignored). - status: a stopped service that does not respond is STOPPED (gray), excluded from uptime and DOWN alerts. If it responds it is UP as usual. - Infra deploy.sh skips stopped stacks; app repo pushes clear the flag. - claude-code@.service: Restart=on-failure, and restart-sessions.sh restarts one unit at a time, to avoid the tmux "server exited unexpectedly" race. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01N5eS3U54gzjRXzm65Np1RS

hetzner-admin: add passkey login (password login kept)

2026-10-31T10:51:15Z

Replace Basic auth with a session-cookie login page. After password login, register a passkey from the bottom of the page; later logins can use it. Passkeys are stored in hetzner-admin/data/ (gitignored). Co-Authored-By: Claude Opus 5.5

Dedupe Caddyfile with snippets, sync docs with reality, add tests/check.sh

2026-07-11T11:35:09Z

- Caddyfile: extract repeated header blocks into (noindex)/(crawler_bypass) snippets (adapted JSON verified byte-identical to previous config) - CLAUDE.md: add mosquitone-admin/microblog to repos table; document that proxy auth is disabled (PROXY_NO_AUTH=1) with JP-only IP filter instead - Deploy.md/caddy/README.md: reflect all-service deploy and forward proxy - tests/check.sh: shell/python syntax, repos.txt<->hooks<->sessions.txt consistency, app.py COMMANDS vs run-command.sh whitelist, secrets check Co-Authored-By: Claude Opus 4.7

Restrict proxy to Japan IPs using ipdeny.com CIDR list

2026-07-02T15:45:51Z

Downloads jp-aggregated.zone from ipdeny.com at container startup (no account required). Falls back to open access if download fails. Removed caddy-maxmind-geoip module (no longer needed). Co-Authored-By: Claude Sonnet 4.6

Add GeoIP Japan-only filter to forward proxy

2026-07-02T15:40:17Z

Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs. DB file (GeoLite2-Country.mmdb) must be placed manually on the server. Filter is inactive when DB file is absent, allowing safe rollout. Co-Authored-By: Claude Sonnet 4.6

Add hetzner-admin: SSH-based server management web UI

2026-06-19T04:39:27Z

Basic Auth protected web UI with buttons to restart services and reboot. SSH key with authorized_keys command= restriction limits executable commands. Co-Authored-By: Claude Sonnet 4.6

Initial: shared Caddy reverse proxy on web network

2026-05-08T14:42:07Z