Serve the stack from this repository's Compose files instead of the Co-op
Cloud recipe on the host, add the docs wiki as a first-class service, and
update the pinned images.
- Add a `wiki` service (wiki/Dockerfile, MkDocs Material 9.7.7 -> nginx)
routed at WIKI_HOST, in both the base and production compose files.
- Traefik v2.11 -> v3.7.14 (v2.11 reached end of security support
2026-09-07); web image nginx 1.31.7-alpine and alpine 3.24.
- `captionninja` (dc1094f): relay on Node 24 LTS. `caption-local` (5bee28c):
GPU image on CUDA 12.9.2.
- `.env.production`: production hostnames for *.captions.dev.autonomic.zone.
- Docs (README, AGENTS, CONFIGURATION) and CHANGELOG updated for the wiki
service, the new hostnames and the image bumps.
Mount a persisted caption-local-keys volume at /data and load the optional
secrets/caption-local.env in both Compose files. The relay now reads a single
origins-only secrets/relay.json holding the shared master secret instead of
per-room tokens, so drop secrets/relay-tokens.env. Rewrite the README, AGENTS and
configuration guide for per-user keys, invites and derived relay rooms.
Bump caption-local to 116c3d0 and captionninja to 9105535.
Add the production healthchecks to docker-compose.yml so docker compose ps reports healthy locally, and default the UI to the local relay (ws://localhost:8080/ws) and capture page (http://localhost:8765/) so the landing-page links work without manual configuration.
Refresh the stale submodule-pin references in CHANGELOG/AGENTS and document the local defaults in README and docs/CONFIGURATION.md.
- caption-local e5637d1 and captionninja d1ac36e: no built-in relay or
caption site; pages ask for a relay instead of using api.caption.ninja.
- docker-compose.prod.yml takes CAPTURE_HOST, RELAY_HOST and UI_HOST from
.env.production (required) instead of hardcoding captions.dev hosts.
- Docs and the AGENTS.md example use example.org placeholders.
- web/: nginx image with the captionninja pages only (no relay source or
secrets), templated by RELAY_URL / CAPTURE_URL / RELAY_UPSTREAM, serving
/site-config.js, refusing dotfiles, and downloading translation models
(SHA-256 verified) into a volume on start-up. Replaces nginx.conf and the
bind mount of the whole captionninja checkout, which served
captionninja/relay/.caption-ninja-relay.private.json publicly.
- Relay private JSON default moved to secrets/relay.private.json.
- Submodule bumps (shallow clones):
caption-local 709fe68: private-only relay auto-fill, RELAY_SITE, no dev
hostnames, Firefox sample-rate fallback.
captionninja 891947c, fc01952, e39bbaa: overlay XSS fix, site-config.js
for links.html, translation models no longer committed.
- Docs and changelog updated.
Rewrite README with a step-by-step first-run path (clone, relay config,
optional Whisper token and capture-page auto-fill, start) and fix stale
loopback ports, relay WebSocket URLs, the .env.production tracked-file note
and duplicate sections. Document relay-tokens.env and /relay-config in
CONFIGURATION.md and AGENTS.md, and declare secrets/caption-local.env with
required: false so the trusted-loopback model needs no secrets.
- Bind all base-stack ports to loopback only; public traffic goes through
Traefik in the production override.
- Point the prod routers at the real captions.dev.autonomic.zone hostnames,
add the whisper-host Host-rewrite middleware, and pass the ACME email on the
Traefik command line.
- Replace the prod health checks with tooling present in each image
(caption-local healthcheck.py, relay Node fetch, web busybox wget, traefik
ping).
- Add docker-compose.auth.yml, an opt-in basicAuth overlay that reads
secrets/traefik.htpasswd.
- Configure the Docker provider with exposedByDefault=false and expose ping.
- Update README and docs/CONFIGURATION.md for the new workflow and secrets.
kawaiipunk
trav