- login.css/wallet.js: replace 2-tab (generate/import) UX with 3 big options
— Create a new wallet [easiest], Import / add a wallet, Connect a wallet —
WizardConnect [most private] (Cashonize/Paytaca placeholder, "coming soon").
- Caddyfile (both hostnames): /user/login now 302→ /user/oauth2/hephaestus-wallet.
Escape hatch: /user/login?password=1 falls through to Forgejo's password form,
linked from the picker footer as "Prefer old-school? Sign in with username & password".
Architecture shift: hephaestus.x used to be Sia-bucket-only (via bns-gateway's
s3: record type). Now it's VPS-served with Silent Mode CA cert; the Sia bucket
stays populated as a disaster-recovery mirror that a single Argus CLI call
(update.js flipping ip: → s3:) can promote back to primary if the VPS dies.
Every code.silentmode.st URL now also works at hephaestus.x — the same Caddy
handles both hostnames; hephaestus.x additionally checks /srv/hephaestus.x/
for a matching static file first, so /forge/, /silentmode/theseus/, and the
other landing pages don't get eaten by Forgejo's dynamic routes.
- caddy/Caddyfile: add hephaestus.x server block with the Argonautica-issued
cert; static-first, Forgejo-fallback
- docker-compose.yml: mount ./caddy (whole dir, for certs/) and
/var/www/hephaestus.x → /srv/hephaestus.x
- scripts/sync-hephaestus-x-to-sia.sh: nightly rclone sync as DR backup
Off-tree changes (kept in memory record for future sessions):
- Silent Mode CA issued hephaestus.x.crt (fingerprint
6e251c2bb4987e66890aa28ebc8e16df5dfe03c1fc559634246ae69c2e00400b)
- BCNR record on hephaestus.x flipped to {"ip":"81.31.210.65","tls":"6e251c2b..."}
(TXID fdd301a2ae313636f71ec4dfba9a3ff723a9158b4a3937ac4ce0a83b3f8cda11)
- systemd timer hephaestus-x-sia-sync.timer on the p2pexchange VPS, 03:35 UTC daily
Add Hephaestus/caddy/Caddyfile - Caddy reverse-proxies both containers on
{$SITE_HOSTNAME} (from docker-compose .env): /auth/* -> auth-proxy:4000 with
the prefix stripped, / -> forgejo:3000 with a 2GB body cap for git push, LFS,
and release uploads. HTTPS via automatic Lets Encrypt (HTTP-01 on :80); SSH
git access stays on 2222 outside Caddy.
docker-compose.yml wires the new caddy service alongside the two existing
containers; auth-proxy/src/index.ts gets the minor upstream adjustment so
paths line up after Caddy strips the /auth prefix.
