fix: route Syncthing web UI through Traefik with HTTPS

Reviewed-on: #28

ai/compose.yml

@@ -54,6 +54,10 @@ services:
       - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/org-ro:/opt/data/org-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/org-rw:/opt/data/org-rw:rw
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -63,6 +67,35 @@ services:
     networks:
       - ai_backend
 
+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/org-ro:/org-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/org-rw:/org-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
   ollama:
     build:
       context: ./ollama

vpn/Dockerfile

@@ -2,8 +2,8 @@
 # Fixes crash-loop when host kernel lacks legacy iptable_nat module.
 FROM ghcr.io/wg-easy/wg-easy:latest
 
-# The upstream image defaults to iptables-legacy via update-alternatives.
+# The upstream image registers only iptables-legacy with update-alternatives.
-# Switch iptables to the nftables backend (already provided by the 'iptables'
+# iptables-nft binary exists but isn't registered as an alternative key.
-# package on Alpine 3.18+). No apk add needed — iptables-nft is built-in.
+# Override the alternatives-managed symlinks directly.
-RUN update-alternatives --set iptables /usr/sbin/iptables-nft && \
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables