docs: add castopod/prime compose mirrors and refresh host snapshots

Mirror live compose for castopod and prime (qBittorrent password
redacted). Update firewalld list-all with 9200/tcp. Mark
Caddyfile.taler-host as legacy; short READMEs for new trees.

2026/2026-07-10.md

@@ -11,3 +11,4 @@
   → vecigate-admin-log CHANGELOG 2026-07-10; `configs/firewalld/public-ports.md`
 - **admin-log origin** → Forgejo `hernani/koopa-admin-log` on git.hacktivism.ch (public; SSH :9200)
   → topic: `2026-07-10--admin-log-origin-forgejo.md`
+- admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy

README.md

@@ -26,6 +26,7 @@ configs/                   # mirrored app configs (caddy, taler, forgejo, …)
   taler-merchant/          # overrides + nginx (same tree style as exchange)
   taler-exchange/          # overrides + coins
   forgejo/                 # rootless git.hacktivism.ch
+  castopod/ bonfire/ prime/ # compose mirrors (no secret values)
 scripts/                   # merchant, exchange, monitoring helpers
   taler-merchant/          # merchant-model start scripts
   taler-exchange/          # same model; archive/ = greenfield bootstrap

SECRETS.md

@@ -17,7 +17,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 
 | What | Mirror | Live |
 |------|--------|------|
-| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
+| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
 | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |

configs/caddy/Caddyfile.taler-host

@@ -1,5 +1,12 @@
+# LEGACY — historical Taler-only Caddy sketch (merchant backend :8081).
+# Do NOT use on koopa. Current multi-vhost config:
+#   configs/caddy/Caddyfile  (canonical)
+#   host/caddy/Caddyfile     (same content)
+#
+# Kept only as archaeology of the early taler.hacktivism.ch TLS layout.
+
 # Multi-domain reverse proxy (TLS terminate on host)
-# Backend today: container nginx TLS on 8081
+# Backend at the time: container nginx TLS on 8081
 
 {
 # no global auto-HTTPS email yet; per-site manual certs
@@ -13,8 +20,5 @@ taler.hacktivism.ch {
 transport http {
 tls_insecure_skip_verify
 }
-		header_up Host {host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
 }
 }

configs/caddy/README.md

@@ -0,0 +1,9 @@
+# Caddy config mirrors
+
+| File | Role |
+|------|------|
+| **`Caddyfile`** | Canonical mirror of host multi-vhost config (`/etc/caddy/Caddyfile`) |
+| `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo |
+| `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy |
+
+Also: `host/caddy/Caddyfile` (same as `Caddyfile` here).

configs/castopod/README.md

@@ -0,0 +1,14 @@
+# Castopod — castopod.hacktivism.ch
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-castopod/` |
+| Compose | `compose.yml` (this dir = mirror) |
+| Port | **9020** → Caddy |
+| Content note | `2026/2026-07-09--castopod-content.md` |
+
+Secrets: `koopa-admin-secrets/…/koopa-castopod/{.env,users.env}` (not in this repo).
+
+```bash
+cd ~/koopa-castopod && set -a && source .env && set +a && podman-compose up -d
+```

configs/castopod/compose.yml

@@ -0,0 +1,79 @@
+# koopa-castopod — Castopod behind host Caddy on :9020
+# Docs: https://docs.castopod.org/main/en/getting-started/docker/
+services:
+  castopod:
+    image: docker.io/castopod/castopod:1
+    container_name: koopa-castopod
+    volumes:
+      - castopod-media:/app/public/media
+    environment:
+      MYSQL_DATABASE: castopod
+      MYSQL_USER: castopod
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+      CP_BASEURL: ${CP_BASEURL}
+      CP_ANALYTICS_SALT: ${CP_ANALYTICS_SALT}
+      CP_CACHE_HANDLER: redis
+      CP_REDIS_HOST: redis
+      CP_REDIS_PASSWORD: ${MYSQL_PASSWORD}
+    networks:
+      - castopod-app
+      - castopod-db
+    ports:
+      - "9020:8080"
+    labels:
+      org.hacktivism.service: castopod
+      org.hacktivism.host_port: "9020"
+      org.hacktivism.site: castopod.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_started
+
+  mariadb:
+    image: docker.io/library/mariadb:11
+    container_name: koopa-castopod-mariadb
+    networks:
+      - castopod-db
+    volumes:
+      - castopod-db:/var/lib/mysql
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: castopod
+      MYSQL_USER: castopod
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      start_period: 20s
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: docker.io/library/redis:7-alpine
+    container_name: koopa-castopod-redis
+    command: --requirepass ${MYSQL_PASSWORD}
+    volumes:
+      - castopod-cache:/data
+    networks:
+      - castopod-app
+    restart: unless-stopped
+
+volumes:
+  castopod-media:
+  castopod-db:
+  castopod-cache:
+
+networks:
+  castopod-app:
+  castopod-db:
+    internal: true

configs/prime/README.md

@@ -0,0 +1,16 @@
+# Prime — Jellyfin + qBittorrent
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-prime/` |
+| Compose | `compose.yml` (this dir; **no secret values**) |
+| Jellyfin | **9022** → Caddy `prime.hacktivism.ch` |
+| qBittorrent | **9023** → Caddy `bt.hacktivism.ch` |
+| Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` |
+
+`WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in  
+`koopa-admin-secrets/…/koopa-prime/` / host env (not admin-log).
+
+```bash
+cd ~/koopa-prime && podman-compose up -d
+```

configs/prime/compose.yml

@@ -0,0 +1,47 @@
+# koopa-prime — Jellyfin + qBittorrent
+# Media source: /home/hernani/Downloads
+services:
+  jellyfin:
+    image: docker.io/linuxserver/jellyfin:10.10.7
+    container_name: koopa-prime-jellyfin
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+      - JELLYFIN_PublishedServerUrl=https://prime.hacktivism.ch
+    volumes:
+      - ./config/jellyfin:/config
+      - ./cache:/cache
+      - /home/hernani/Downloads:/media/downloads:ro
+    ports:
+      - "9022:8096"
+    labels:
+      org.hacktivism.service: jellyfin
+      org.hacktivism.host_port: "9022"
+      org.hacktivism.site: prime.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+
+  qbittorrent:
+    image: docker.io/linuxserver/qbittorrent:5.0.4
+    container_name: koopa-prime-qbittorrent
+    restart: unless-stopped
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+      - WEBUI_PORT=8080
+      - WEBUI_PASSWORD=${WEBUI_PASSWORD}
+      - TORRENTING_PORT=6881
+    volumes:
+      - ./config/qbittorrent:/config
+      - /home/hernani/Downloads:/downloads
+    ports:
+      - "9023:8080"
+      - "6881:6881"
+      - "6881:6881/udp"
+    labels:
+      org.hacktivism.service: qbittorrent
+      org.hacktivism.host_port: "9023"
+      org.hacktivism.site: bt.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin

host/firewalld/list-all.txt

@@ -6,7 +6,7 @@ public (default, active)
   interfaces: eno1
   sources: 
   services: dhcpv6-client ssh
-  ports: 23235/tcp 8080/tcp 9000/tcp 9001/tcp 80/tcp 443/tcp
+  ports: 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
   protocols: 
   forward: yes
   masquerade: no
@@ -14,3 +14,6 @@ public (default, active)
   source-ports: 
   icmp-blocks: 
   rich rules: 
+
+# Snapshot note (2026-07-10): 9200/tcp = Forgejo git-SSH (verified open).
+# Re-export as root: firewall-cmd --list-all > host/firewalld/list-all.txt