| 1 | diff --git a/docs/personal-relay.md b/docs/personal-relay.md |
| 2 | index 9cb04f2..0e74507 100644 |
| 3 | --- a/docs/personal-relay.md |
| 4 | +++ b/docs/personal-relay.md |
| 5 | @@ -1,58 +1,10 @@ |
| 6 | # Personal relay deployment |
| 7 | |
| 8 | -The personal relay runs on a Linux Docker host and is published through Tailscale Funnel at [https://tiny.tailbe516a.ts.net](https://tiny.tailbe516a.ts.net). The relay, Caddy and Tailscale containers share one network namespace, so only that node's port 443 is public; the host itself stays private. |
| 9 | - |
| 10 | -## Public access |
| 11 | - |
| 12 | -Funnel forwards raw TLS on port 443 to Caddy inside the relay's Tailscale node. Caddy keeps terminating TLS with the tailnet certificate, so nothing else changes. The setting persists in the Tailscale state directory across container restarts. |
| 13 | - |
| 14 | -```sh |
| 15 | -docker exec tiny-tailscale tailscale funnel --bg --tcp=443 tcp://127.0.0.1:443 |
| 16 | -docker exec tiny-tailscale tailscale funnel status |
| 17 | -docker exec tiny-tailscale tailscale funnel --tcp=443 off |
| 18 | -``` |
| 19 | - |
| 20 | -Public DNS for the relay name resolves to Tailscale's ingress only while Funnel is on; tailnet devices keep using the direct path. Writes stay restricted to members, so public visitors can read and sign in but cannot publish without an invitation. The relay sees the loopback address for every connection behind Caddy, so IP based blocks apply to the proxy rather than to individual clients. |
| 21 | - |
| 22 | -## Storage |
| 23 | - |
| 24 | -The relay data lives on a dedicated 2 TB WD drive mounted at `/srv/tiny`. The drive uses UUID `98f49cba-bd8c-432d-a91a-41db66920e90` and is formatted as ext4. |
| 25 | - |
| 26 | -Persisted directories include: |
| 27 | - |
| 28 | -- `/srv/tiny/data` for relay and tenant data |
| 29 | -- `/srv/tiny/tailscale` for Tailscale state |
| 30 | -- `/srv/tiny/certs` for certificates |
| 31 | -- `/srv/tiny/logs` for service logs |
| 32 | - |
| 33 | -The service checks the drive's UUID before starting and stops if the mount disappears. |
| 34 | - |
| 35 | -## Service operations |
| 36 | - |
| 37 | -The service is `tiny.service`, with certificate renewal scheduled by `tiny-certificates.timer`. |
| 38 | - |
| 39 | -In the Tailscale admin console, open **Machines > tiny > Endpoints** to find the HTTP and HTTPS listeners. The node's key expiry is disabled. |
| 40 | - |
| 41 | -```sh |
| 42 | -ssh <host> sudo systemctl status tiny |
| 43 | -ssh <host> sudo systemctl restart tiny |
| 44 | -ssh <host> sudo systemctl status tiny-certificates.timer |
| 45 | -ssh <host> docker logs tiny |
| 46 | -``` |
| 47 | - |
| 48 | -To deploy an update, build the images from a checkout on the host, then restart the service: |
| 49 | - |
| 50 | -```sh |
| 51 | -docker build --target runtime -t tiny:dogfood . |
| 52 | -docker build -f deploy/Tailscale.Dockerfile -t tiny-tailscale:dogfood deploy |
| 53 | -sudo systemctl restart tiny |
| 54 | -``` |
| 55 | - |
| 56 | -The owner is `npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5`. Sign in with that identity to manage the relay. |
| 57 | +The personal relay runs on a Linux Docker host. Tailnet devices reach it at [https://tiny.tailbe516a.ts.net](https://tiny.tailbe516a.ts.net); everyone else reaches it through the Fly edge at `https://012.run`. The relay, Caddy and Tailscale containers share one network namespace, so nothing on the host itself listens publicly. |
| 58 | |
| 59 | ## Public domain through a Fly edge |
| 60 | |
| 61 | -The relay is also reachable at `https://012.run`, with sites on `*.012.run`. A small Fly machine, `deploy/edge`, terminates TLS at Fly's edge, joins the tailnet in userspace mode, and forwards plain HTTP over the tailnet to a listener on the relay host that only the tailnet can reach. Fly's proxy has no request body cap and passes WebSockets. |
| 62 | +The public address is `https://012.run`, with sites on `*.012.run`. A small Fly machine, `deploy/edge`, terminates TLS at Fly's edge, joins the tailnet in userspace mode, and forwards plain HTTP over the tailnet to a listener on the relay host that only the tailnet can reach. Fly's proxy has no request body cap and passes WebSockets. |
| 63 | |
| 64 | ```sh |
| 65 | cd deploy/edge |
| 66 | @@ -62,7 +14,7 @@ fly certs check 012.run |
| 67 | fly certs check "*.012.run" |
| 68 | ``` |
| 69 | |
| 70 | -DNS at the registrar, all DNS-only records: A and AAAA for `012.run` and `*.012.run` pointing at the app's addresses from `fly ips list`, and a `_acme-challenge.012.run` CNAME from `fly certs setup "*.012.run"` for the wildcard certificate. The relay host's Caddyfile serves `012.run:8080` and `*.012.run:8080` over plain HTTP for the edge; see `deploy/edge/slate.Caddyfile.snippet`. After the certificates issue, set `--public-url https://012.run` on the relay so signed requests, NIP-11 and site hosts use the public name. The ts.net name keeps working through Funnel. |
| 71 | +DNS at the registrar, all DNS-only records: A and AAAA for `012.run` and `*.012.run` pointing at the app's addresses from `fly ips list`, and a `_acme-challenge.012.run` CNAME from `fly certs setup "*.012.run"` for the wildcard certificate. The relay host's Caddyfile serves `012.run:8080` and `*.012.run:8080` over plain HTTP for the edge; see `deploy/edge/slate.Caddyfile.snippet`. After the certificates issue, set `--public-url https://012.run` on the relay so signed requests, NIP-11 and site hosts use the public name. The ts.net name stays tailnet only. |
| 72 | |
| 73 | ## Repository hosting |
| 74 | |