I’m slowly/manually/painfully rebuilding my knowledgebase from scratch. That’s going to take a while, but, and I’m going to trigger all the engineers here right now (you know who you are):
Arbitrarily deep nested note trees is best note trees.
So:
- Trilium’s up
- Ombi’s up, but it’s going to need some further setup before it’s useful.
- The SSL is improved drastically, but I think nginx is still breaking the site for some (mostly mobile) remote usecases. (I’ll be poking PLL to see if he knows what’s specifically wrong on that at some point. Maybe tomorrow if he’s free.)
- The gateway seems to be primarily functional, however.
- I have my list of containers to implement again, so progress will go well.
- We are working on the task of splitting the composes into ‘type’ folders, so there’s no monolithic docker stack. Better for troubleshooting.
Actually, Trilium in particular is fascinating because it’s so easy to set up. Most of the notes options that are out there require a second linked database, and other requirements. Let’s look at what Trilium requires in the Compose file, with some extra documentation that sheds some light on my practices during this project:
# Trilium - Personal knowledgebase / notes server sync.
trilium:
image: zadam/trilium
container_name: trilium
# It's really nice that these can be arbitrary, but for a simple homelab
# for production/use purpose, the service name seems best.
restart: unless-stopped
networks:
- default
- t2_proxy
- tools
# The first two of these are required for Traefik and Socket Proxy to play nice.
# The last one, however, is me isolating containers from eachother by purpose.
# (I have another one called 'content' for example).
# There's still traefik and DSP talking to everything, but I see this as hardening.
ports:
- "8078:8080"
env_file:
- ./defaults.env
# This is one of my favorite things about the compose, above
# (and secrets, which isn't relevant here).
#There's no need to clutter the compose for a given stack.
labels:
- "traefik.http.routers.trilium.rule=Host(`trilium.$DOMAINNAME`)"
- "traefik.docker.network=t2_proxy"
# Traefik's labels seem intimidating, but follow certain rules (if I understand them correctly)
volumes:
- $NOTESDIR:/data
# Simple directory declaration based on the .env mentioned above
security_opt:
- no-new-privileges:true
# This should be on everything.
The only real issue with Trilium, to me? It’s single-user as far as I can tell.
,
The private key generated by Certbot that goes alongside the certificate is also not password protected and for good reason it only need to be protected by filesystem permissions and shouldn’t be shared. This is up to you. There is no good reason to share it. There is no sound reason to encrypt it within the permissions it already sits in. If your system is compromised to this level your data is already done for with or without this cert being protected.
you are beholden to them. and guess what… A signature does not make something trustworthy. When a message X is signed and the signature is successfully verified with public key XKp, then cryptography tells you that the message X is exactly as it was when the owner of the corresponding private key XKpriv computed that signature. This does not automatically tell you that the contents of X are true… Now moving on to what the certificate does … it moves the key distribution problem: initially your problem was that of knowing the server’s public key right? I said this earlier