caddy: serve the Hub, RTL and Mempool sites to local clients only

The Hub (sovransystemsos.local), Ride The Lightning (:3051) and Mempool (:60847) sites are meant for the home network. With ports 80/443 forwarded for public services, Caddy also receives requests from other clients, so these sites now check the client address as well as the Host header. A new snippet, sovran_lan_only, closes the connection unless the client is on this computer or the local network: private_ranges, 100.64.0.0/10 (Tailscale), 169.254.0.0/16, fe80::/10 and fc00::/7. IPv6 global addresses (2000::/3) are not filtered: computers on the network often connect over their own global address, which cannot be told apart from one on the internet by the address alone. Only the three local sites import the snippet; the domain sites for public services are unchanged. Clients with a public IPv4 address on the local network are no longer served on these sites. The Hub is still available on port 8937. Checked with Caddy 2.11.4 and the Caddyfile the generator writes: public IPv4 clients get the connection closed on all three sites, local clients are served, and the public domain sites answer as before. Add tests/test_caddy_lan_only.py and a note in SECURITY.md.
docs, hub, installer: say Server + Desktop makes the home IP public
2026-10-01 21:43:47 -05:00 · 2026-10-01 21:43:47 -05:00 · 2026-10-01 21:43:47 -05:00 · 2026-10-01 13:36:12 -05:00 · 2026-09-21 18:09:10 -05:00 · 2026-09-21 18:07:21 -05:00
25 changed files with 1148 additions and 649 deletions
@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ---

+## [1.1.7] - 2026-09-21
+
+### Added
+- Postgresql: drop per-database autovacuum ALTERs (rejected by Postgres)
+- Synapse: performance tuning for 32 GB Server+Desktop hosts
+- Nextcloud, postgresql: fix Nextcloud 35 DB warnings on 32 GB hosts
+- Clean up flake.nix by removing comments and LiveKit override
+
+### Changed
+- Updated nixpkgs
+- Updated to php85 and fixes
+- Updated to proper syntax to prevent build errors.
+- Updated flake lock which contains Bisq 1.10.8 and Bisq2 2.1.13
+[1.1.7]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.7
+
+
+## [1.1.6] - 2026-09-15
+
+### Added
+- Rename 'The Sovran Hub' to 'The Hub' in README
+- Rename 'Sovran Hub' to 'The Hub' in README
+
+### Changed
+- Updated nix packages includes the new mempool version
+
+### Documentation
+- Update Sovran Hub screenshot to the v1.1.5 redesign
+[1.1.6]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.6
+
+
 ## [1.1.5] - 2026-09-09

 ### Added
@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.

 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.5.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.7.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.5.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.7.iso.sha256) ·
 [Build from Source](#build-from-source)

 <img src="assets/desktop-screenshot.webp" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -45,7 +45,7 @@ are ready.
 - [What is included](#what-is-included)
 - [Three modes](#three-modes)
 - [Use it your way](#use-it-your-way)
- [The Sovran Hub](#the-sovran-hub)
+- [The Hub](#the-hub)
 - [Install Sovran_SystemsOS](#install-sovran_systemsos)
 - [For developers](#for-developers)
  - [Development workflow](#development-workflow)
@@ -202,7 +202,7 @@ Bitcoin and self-hosting infrastructure runs on the machine.
 |---|---|---|
 | **Desktop** | Everyday users and computers with modest hardware | Sparrow, Bisq, and Bisq 2 for self-custody and peer-to-peer Bitcoin use |
 | **Node** | People ready to verify and operate their own Bitcoin infrastructure | Everything in Desktop, plus the full Bitcoin stack: Bitcoin Core, Electrs, LND, Ride The Lightning, BTCPay Server, and wallet-to-node connections |
-| **Server + Desktop** | Bitcoiners who want the same sovereignty over their communications, cloud, passwords, and web services | The complete Node stack, plus the private self-hosted services |
+| **Server + Desktop** | Bitcoiners who want the same sovereignty over their communications, cloud, passwords, and web services | The complete Node stack, plus the private self-hosted services. **Makes your home IP address public:** [read this first](#server--desktop-and-your-home-ip-address) |

 **Desktop: start with your keys.** Desktop is not a reduced or Bitcoin-free
 edition. It is a complete, private everyday computer with a clean GNOME
@@ -237,6 +237,66 @@ communications, identity, and services.
 > provider allows port forwarding. Most home routers and providers already
 > support this. If you are unsure, a quick search for your router model and
 > "port forwarding" will usually turn up a step-by-step guide.
+>
+> **This mode also makes your home IP address public.** Read
+> [what that means](#server--desktop-and-your-home-ip-address) before you
+> choose it.
+
+### Server + Desktop and your home IP address
+
+> **⚠️ Server + Desktop makes your home IP address public.**
+> Public services need a domain name that points at your home internet
+> connection. When you finish the guided domain setup, Sovran_SystemsOS puts
+> your home's public IP address in a Dynamic DNS record at
+> [Njal.la](https://njal.la) and keeps it up to date, and you forward ports 80
+> and 443 on your router to this computer. From then on:
+>
+> - **Anyone can look up your domain and see your home IP address.** An IP
+>   address typically reveals your internet provider and your approximate
+>   location, and it ties everything you publish on that domain to your home
+>   connection.
+> - **Domain privacy does not hide it.** Registrar privacy protects the
+>   registrant's identity, not the IP address in your DNS records.
+> - **Your connection is open to the whole internet on those ports.** Scanners
+>   and bots constantly probe public IP addresses, so expect automated probing
+>   and login attempts against every service you publish.
+> - **Your service names are discoverable.** Public HTTPS certificates are
+>   listed in public Certificate Transparency logs, so hostnames such as
+>   `vault.yourdomain.com` can be found, and then resolved to your IP address,
+>   even if you never share them.
+
+Nothing is published until you finish domain setup and port forwarding, but that
+setup is the point of this mode, so assume your IP address will be public.
+**Desktop** publishes nothing. **Node** publishes nothing unless you turn on a
+feature that needs a domain: *Put BTCPay Server Online* or *Lightning Wallet
+Connections*.
+
+**If you do not want your home IP address to be public,** choose Desktop or
+Node. Advanced users can put a VPS, reverse proxy, or tunnel in front of their
+services so DNS points there instead of at their home. Sovran_SystemsOS does not
+set this up for you, and the Hub's domain checks currently expect DNS to point
+at your home IP address.
+
+<details>
+<summary><strong>What happens technically</strong></summary>
+
+- You create a **Dynamic** DNS record at Njal.la and paste its update command
+  into the Hub. The Hub only accepts `njal.la` update URLs.
+- The `sovran-ddns-update` timer asks Njal.la to point your record at the
+  address the request came from. It does this right after you save a domain,
+  two minutes after boot, and then every 15 minutes.
+- Njal.la reports that address back, and Sovran_SystemsOS keeps it for Element
+  calling and the Hub. Nothing else looks up your public IP address: no STUN
+  server, public DNS resolver, or "what is my IP" service is involved. See
+  `modules/core/njalla.nix`.
+- Once a service that needs a domain is turned on, the firewall opens TCP and
+  UDP ports 80 and 443 for Caddy, which requests public HTTPS certificates for
+  the domains you configure. See `modules/core/caddy.nix`.
+- Optional features can need more ports. Element calling, for example, needs
+  TCP 7881 and UDP 3478, 7882, and 40000–40099. The Hub lists the ports each
+  feature needs.
+
+</details>

 ---

@@ -264,11 +324,11 @@ infrastructure behind them.

 ---

-## The Sovran Hub
+## The Hub

 ### Your private infrastructure, controlled from any screen.

-The Sovran Hub is the command center built into Sovran_SystemsOS. It is both a
+The Hub is the command center built into Sovran_SystemsOS. It is both a
 local desktop application and a private web interface served directly by your
 Sovran_SystemsOS machine. Nothing needs to be installed on the device opening
 the Hub: you only need a modern browser and access to the same local network.
@@ -281,9 +341,9 @@ From one place, the Hub helps you:
 - Reach your Bitcoin tools, private cloud, and communications
 - Perform supported system operations without everyday terminal commands

-<img src="assets/sovran-hub-screenshot.webp" alt="The Sovran Hub dashboard" width="800" />
+<img src="assets/sovran-hub-screenshot.webp" alt="The Sovran Hub welcome dashboard" width="800" />

-*The Sovran Hub: manage your private infrastructure from one place.*
+*The Hub: your whole system at a glance — Bitcoin, Lightning, and your private apps.*

 ### Example home setup

@@ -300,7 +360,7 @@ From one place, the Hub helps you:
                    ┌──────────────────────────┐
                    │   Sovran_SystemsOS       │
                    │                          │
-                    │   • Sovran Hub           │
+                    │   • The Hub           │
                    │   • Bitcoin node         │
                    │   • Sparrow Wallet       │
                    │   • Bisq and Bisq 2      │
@@ -345,8 +405,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).

 ### 1. Download the ISO and checksum

- [Download Sovran_SystemsOS-1.1.5.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.5.iso)
- [Download Sovran_SystemsOS-1.1.5.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.5.iso.sha256)
+- [Download Sovran_SystemsOS-1.1.7.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.7.iso)
+- [Download Sovran_SystemsOS-1.1.7.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.7.iso.sha256)

 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -364,16 +424,16 @@ checksum exactly.
 Open a terminal in the download folder and run:

 ```bash
-sha256sum --check Sovran_SystemsOS-1.1.5.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.1.7.iso.sha256
 ```

 A successful comparison reports:

 ```text
-Sovran_SystemsOS-1.1.5.iso: OK
+Sovran_SystemsOS-1.1.7.iso: OK
 ```

-You can also run `sha256sum Sovran_SystemsOS-1.1.5.iso` and compare the output
+You can also run `sha256sum Sovran_SystemsOS-1.1.7.iso` and compare the output
 against the checksum file manually.

 </details>
@@ -384,11 +444,11 @@ against the checksum file manually.
 Open Terminal in the download folder and run:

 ```bash
-shasum -a 256 Sovran_SystemsOS-1.1.5.iso
+shasum -a 256 Sovran_SystemsOS-1.1.7.iso
 ```

 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS-1.1.5.iso.sha256`.
+`Sovran_SystemsOS-1.1.7.iso.sha256`.

 </details>

@@ -398,7 +458,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:

 ```powershell
-Get-FileHash .\Sovran_SystemsOS-1.1.5.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.1.7.iso -Algorithm SHA256
 ```

 Compare the value under `Hash` with the published checksum.
@@ -413,7 +473,7 @@ match exactly.

 1. Download and install [Balena Etcher](https://etcher.balena.io), then
   connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS-1.1.5.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.1.7.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
   carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -730,7 +790,9 @@ Sovran_SystemsOS uses layered controls:
 - Separate service users, systemd sandboxing, and loopback bindings where practical
 - Tor enforcement for supported Bitcoin services
 - Restricted, time-limited support access with scoped `sudo`
- Operator-controlled public service exposure
+- Operator-controlled public service exposure (Server + Desktop
+  [makes your home IP address public](#server--desktop-and-your-home-ip-address)
+  once you set up a domain)

 See [`SECURITY.md`](SECURITY.md) for the threat model, limitations, reporting,
 and operator guidance. No operating system can protect funds after recovery
@@ -856,7 +918,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.

 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.5.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.7.iso) ·
 [View the License](LICENSE)

 </div>
@@ -4,7 +4,7 @@

 | Release | Supported |
 |---|:---:|
-| Latest `1.0.x` stable release | Yes |
+| Latest stable release | Yes |
 | `main` / `staging-dev` | Development only |
 | Older than `1.0.0` | No |

@@ -35,6 +35,29 @@ external networks and are outside a “fully offline” model.
 The local Hub currently uses HTTP. Authentication does not encrypt local network
 traffic, so use a trusted LAN and avoid public or guest Wi-Fi.

+Caddy serves the Hub (`sovransystemsos.local`), Ride The Lightning (port 3051),
+and Mempool (port 60847) only to this computer and to clients on your local
+network (private, link-local, and VPN addresses), even when ports 80 and 443 are
+forwarded to this computer for public services. Other IPv4 clients get the
+connection closed. IPv6 global addresses are not filtered.
+
+### Public services and your home IP address
+
+Server + Desktop publishes services under your own domain. The Dynamic DNS
+record at Njal.la then points at your home's public IP address, which anyone
+can look up (domain privacy does not hide it), and ports 80 and 443 are open
+to the whole internet. Public HTTPS certificates also list your service
+hostnames in Certificate Transparency logs. Desktop publishes nothing. Node
+publishes nothing unless *Put BTCPay Server Online* or *Lightning Wallet
+Connections* is on. See
+[Server + Desktop and your home IP address](README.md#server--desktop-and-your-home-ip-address)
+for what this means and the alternatives.
+
+Sovran_SystemsOS does not ask a STUN server, public DNS resolver, or “what is
+my IP” service for your address. The DDNS update asks Njal.la to use the
+address the request came from, and the address Njal.la reports back is the one
+Element calling and the Hub use.
+
 ### Bitcoin stack

 Bitcoin and Lightning modules are maintained in the standalone
@@ -64,7 +87,8 @@ change both the system and local configuration.
 - Separate service users and systemd sandboxing where supported
 - Administrative service ports bound to loopback where practical
 - Tor enforced for supported Bitcoin traffic and onion services
- Public web services exposed only when enabled by the operator
+- Public web services exposed only when enabled by the operator (this makes
+  your home IP address public)

 Tor reduces network exposure for configured Bitcoin services. It is not a
 guarantee against every IP leak, application bug, or traffic-analysis attack.
@@ -1 +1 @@
-1.1.5
+1.1.7
@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+"""Sovran DDNS update runner (sovran-ddns-update.service).
+
+For every stored Njal.la update URL this asks Njal.la to point the record at
+the address the request came from ("&auto"), then reads back the address
+Njal.la says it recorded.  That address is saved to /var/lib/secrets/external-ip,
+where livekit-turn-setup and the Hub read it.
+
+Njal.la is the only party involved.  It has to learn the address to publish
+it, so nothing else -- no STUN server, no public resolver, no "what is my IP"
+service -- is ever asked for it.
+
+Kept from the previous runner:
+  * every URL goes through _validate_ddns_url() (https, njal.la only, /update/)
+  * curl is run directly: no shell, no redirects
+  * the update key is never printed or logged
+
+The module is installed next to security_helpers.py (/etc/sovran/) and run as a
+script by the service; it is also importable as
+sovran_systemsos_web.ddns_update so the tests can exercise it.
+"""
+import ipaddress
+import json
+import os
+import subprocess
+import sys
+import tempfile
+
+try:
+    from .security_helpers import _validate_ddns_url  # imported as part of the Hub package
+except ImportError:  # run as a script from /etc/sovran, next to security_helpers.py
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from security_helpers import _validate_ddns_url
+
+URLS_FILE = "/var/lib/njalla/ddns_urls.json"
+IP_FILE = "/var/lib/secrets/external-ip"
+
+_CGNAT = ipaddress.ip_network("100.64.0.0/10")
+
+
+def is_public_ipv4(value) -> bool:
+    """True for a globally routable IPv4 literal (not private, loopback, CGNAT ...)."""
+    try:
+        ip = ipaddress.ip_address(str(value).strip())
+    except ValueError:
+        return False
+    if ip.version != 4 or ip in _CGNAT:
+        return False
+    # is_global alone is not enough: CPython reports multicast as global.
+    return ip.is_global and not (
+        ip.is_multicast or ip.is_reserved or ip.is_loopback
+        or ip.is_link_local or ip.is_unspecified or ip.is_private
+    )
+
+
+def normalise_url(raw: str) -> str:
+    """Return the URL to call for a stored (or freshly pasted) update URL.
+
+    * Older Hubs stored "...&a=${IP}": the address was looked up locally and
+      substituted.  Njal.la can use the address the request came from, so that
+      placeholder becomes "&auto".
+    * "&quiet" is dropped: the reply is how we learn the address Njal.la recorded.
+    """
+    return raw.replace("&a=${IP}", "&auto").replace("&quiet", "")
+
+
+def parse_reply(body: str):
+    """Return the public IPv4 address Njal.la says it recorded, or None.
+
+    A successful update replies with JSON of the form
+        {"status": 200, "message": "record updated", "value": {"A": "203.0.113.7", ...}}
+    """
+    try:
+        data = json.loads(body)
+    except (TypeError, ValueError):
+        return None
+    if not isinstance(data, dict) or str(data.get("status")) != "200":
+        return None
+    value = data.get("value")
+    ip = value.get("A") if isinstance(value, dict) else None
+    return str(ip).strip() if is_public_ipv4(ip) else None
+
+
+def read_ip_file(path: str = None):
+    """The address recorded by the last successful update, or None."""
+    try:
+        with open(path or IP_FILE) as f:
+            return f.read().strip() or None
+    except OSError:
+        return None
+
+
+def write_ip_file(ip: str, path: str = None) -> None:
+    """Replace the file atomically so a path watcher never sees a partial write."""
+    path = path or IP_FILE
+    directory = os.path.dirname(path)
+    os.makedirs(directory, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=directory, prefix=".external-ip-")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write(ip)
+        os.chmod(tmp, 0o644)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def update_all(urls, *, run=None, validate=_validate_ddns_url):
+    """Call every update URL once; return the address Njal.la reported, or None.
+
+    Nothing secret is printed: URLs are only ever referred to by position.
+    """
+    run = run or subprocess.run  # resolved per call so tests can substitute it
+    reported = None
+    seen = set()
+    todo = []
+    for raw in urls:
+        url = normalise_url(raw)
+        if url not in seen:  # an old "&a=${IP}" entry and its "&auto" twin are one record
+            seen.add(url)
+            todo.append(url)
+    for number, url in enumerate(todo, 1):
+        try:
+            validate(url)
+            proc = run(
+                ["curl", "--silent", "--ipv4", "--max-time", "15", "--fail", "--no-location", url],
+                capture_output=True, text=True, timeout=20, check=False,
+            )
+        except Exception:
+            print(f"DDNS update {number}/{len(todo)}: skipped (invalid URL or curl unavailable)")
+            continue
+        if proc.returncode != 0:
+            print(f"DDNS update {number}/{len(todo)}: failed (curl exit {proc.returncode})")
+            continue
+        ip = parse_reply(proc.stdout)
+        if ip is None:
+            print(f"DDNS update {number}/{len(todo)}: Njal.la did not report a public IPv4 address")
+            continue
+        print(f"DDNS update {number}/{len(todo)}: ok")
+        if reported is None:
+            reported = ip
+        elif ip != reported:
+            print("DDNS: Njal.la reported different addresses for different records; using the first")
+    return reported
+
+
+def main() -> int:
+    try:
+        with open(URLS_FILE) as f:
+            urls = json.load(f)
+        if not isinstance(urls, list):
+            raise ValueError("not a list")
+    except Exception:
+        return 0  # no URLs configured -- nothing to do
+    urls = [u for u in urls if isinstance(u, str)]
+    if not urls:
+        return 0
+
+    ip = update_all(urls)
+    if ip is None:
+        print("DDNS: no address reported by Njal.la; keeping the last known one")
+        return 0
+    previous = read_ip_file()
+    if ip == previous:
+        print(f"DDNS: public IP unchanged ({ip})")
+        return 0
+    write_ip_file(ip)
+    print(f"DDNS: public IP is now {ip} (was {previous or 'unknown'})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -21,7 +21,6 @@ import subprocess
 import tempfile
 import threading
 import time
-import sys
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -41,6 +40,7 @@ from .config import load_config, load_versions
 from . import systemctl as sysctl
 from sovran_nwc import nwc_hub_manager as _nwc_mgr
 from . import support_ops as _support_ops
+from .ddns_update import normalise_url as _normalise_ddns_url
 from .security_helpers import (
    _nix_escape,
    NPUB_RE,
@@ -1008,43 +1008,20 @@ def _save_internal_ip(ip: str):
            pass


-def _save_external_ip(ip: str):
-    """Write the external IP to a file so other services (e.g. LiveKit) can
-    reference it without running their own detection."""
-    if ip and ip != "unavailable":
-        try:
-            os.makedirs(os.path.dirname(EXTERNAL_IP_FILE), exist_ok=True)
-            with open(EXTERNAL_IP_FILE, "w") as f:
-                f.write(ip)
-        except OSError:
-            pass
-
-
 def _get_external_ip() -> str:
-    """Public IP via the shared detector (/var/lib/sovran/public-ip.py).
+    """Public IP as recorded by the Njal.la DDNS runner (ddns_update.py).

-    The detector owns discovery (STUN -> DNS -> opt-in HTTPS echo), caches the
-    result in /var/lib/secrets/external-ip, and contacts at most one third
-    party per refresh interval. This function only reads the cache and asks
-    the detector to refresh when it is missing or stale — it performs no
-    per-call external queries of its own.
+    Nothing here looks the address up or contacts anyone. The DDNS update asks
+    Njal.la to use the address the request came from, Njal.la reports it back,
+    and the runner saves it to EXTERNAL_IP_FILE. Returns "unavailable" until
+    the first successful update (and on machines with no DDNS URL, e.g. Desktop).
    """
-    try:
-        r = subprocess.run(
-            [sys.executable, "/var/lib/sovran/public-ip.py", "check"],
-            capture_output=True, text=True, timeout=20,
-        )
-        if r.returncode == 0 and r.stdout.strip():
-            return r.stdout.strip().splitlines()[0]
-    except Exception:
-        pass
    try:
        with open(EXTERNAL_IP_FILE) as f:
            ip = f.read().strip()
-        if ip:
+        ipaddress.ip_address(ip)
        return ip
-    except OSError:
-        pass
+    except (OSError, ValueError):
        return "unavailable"


@@ -3796,9 +3773,6 @@ async def api_network():
    # Keep the internal-ip file in sync for credential lookups
    _save_internal_ip(internal)
    _cached_external_ip = external
-    # Persist the external IP so other services (e.g. LiveKit) can reuse the
-    # Hub's detection instead of running their own.
-    _save_external_ip(external)
    return {"internal_ip": internal, "external_ip": external}


@@ -4723,48 +4697,23 @@ def _save_ddns_urls(urls: list[str]) -> None:


 def _run_njalla_ddns() -> None:
-    """Update Njal.la DDNS records immediately (best-effort).
+    """Ask the DDNS runner to update Njal.la right away (best-effort, non-blocking).

-    Resolves the current public IP once, then invokes ``curl`` directly as a
-    subprocess for each stored DDNS update URL.  No shell interpolation is
-    performed and no user-controlled value is interpreted as shell syntax.
-    Each URL is revalidated through ``_validate_ddns_url()`` after ``${IP}``
-    substitution; URLs that fail validation are silently skipped.
+    The runner (modules/core/njalla.nix -> ddns_update.py) is the only code that
+    talks to Njal.la. It validates every stored URL, calls it with "&auto" so
+    Njal.la uses the address the request came from, and records the address
+    Njal.la reports back for LiveKit and the Hub (EXTERNAL_IP_FILE).

-    Called when a domain/DDNS entry is saved and when a DDNS-backed feature
-    is enabled, so DNS is refreshed right away instead of waiting for the
-    15-minute timer tick (see modules/core/njalla.nix).
+    Called when a domain/DDNS entry is saved and when a DDNS-backed feature is
+    enabled, so DNS is refreshed right away instead of waiting for the
+    15-minute timer tick.
    """
-    urls = _load_ddns_urls()
-    if not urls:
+    if not _load_ddns_urls():
        return
-    # Resolve current public IP (best-effort; skip if unavailable)
-    public_ip = ""
    try:
-        ip_result = subprocess.run(
-            ["dig", "@resolver4.opendns.com", "myip.opendns.com", "+short", "-4"],
-            capture_output=True, text=True, timeout=10, check=False,
-        )
-        raw_ip = ip_result.stdout.strip().splitlines()[0] if ip_result.stdout.strip() else ""
-        # Validate strictly as a proper IPv4/IPv6 address before substitution
-        ipaddress.ip_address(raw_ip)
-        public_ip = raw_ip
-    except Exception:
-        public_ip = ""
-
-    if not public_ip:
-        return  # skip to avoid sending bare ${IP} to curl
-
-    for raw_url in urls:
-        try:
-            # Replace the placeholder with the validated IP (safe string replacement)
-            url = raw_url.replace("${IP}", public_ip)
-            # Revalidate after substitution — enforces /update/ path, no $, etc.
-            _validate_ddns_url(url)
        subprocess.run(
-                ["curl", "--silent", "--max-time", "15", "--fail", "--no-location", url],
-                timeout=20, check=False,
-                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+            ["systemctl", "start", "--no-block", "sovran-ddns-update.service"],
+            capture_output=True, timeout=10, check=False,
        )
    except Exception:
        pass
@@ -4906,18 +4855,17 @@ async def api_domains_set(req: DomainSetRequest):
        # Strip surrounding quotes
        if len(ddns_url) >= 2 and ddns_url[0] in ('"', "'") and ddns_url[-1] == ddns_url[0]:
            ddns_url = ddns_url[1:-1]
-        # Replace trailing &auto with the IP placeholder used by _run_njalla_ddns
-        if ddns_url.endswith("&auto"):
-            ddns_url = ddns_url[:-5] + "&a=${IP}"
+        # Keep Njal.la's "&auto": Njal.la then uses the address the request comes
+        # from, so nothing on this machine has to look the address up. Old
+        # "&a=${IP}" pastes and "&quiet" are normalised exactly as the runner does.
+        ddns_url = _normalise_ddns_url(ddns_url)
        # Validate URL strictly — reject injection attempts before persisting.
-        # The placeholder ${IP} is replaced temporarily so the validator sees a
-        # real address; the original URL (with the placeholder) is kept for storage.
        try:
-            _validate_ddns_url(ddns_url.replace("${IP}", "127.0.0.1"))
+            _validate_ddns_url(ddns_url)
        except ValueError as exc:
            raise HTTPException(status_code=400, detail=f"Invalid DDNS URL: {exc}")
        # Persist the URL in the JSON store (never in executable shell source)
-        existing_urls = _load_ddns_urls()
+        existing_urls = list(dict.fromkeys(_normalise_ddns_url(u) for u in _load_ddns_urls()))
        if ddns_url not in existing_urls:
            existing_urls.append(ddns_url)
        try:
@@ -6308,13 +6256,12 @@ async def _background_domain_reachability_checker():
    consecutive_failures = 0
    while True:
        try:
-            # Keep the persisted external IP fresh (dynamic WAN IPs), so
-            # services like LiveKit can read /var/lib/secrets/external-ip.
+            # Pick up the address the Njal.la DDNS runner last recorded (a plain
+            # file read; nothing is looked up from here).
            loop = asyncio.get_event_loop()
            external = await loop.run_in_executor(None, _get_external_ip)
            if external != "unavailable":
                _cached_external_ip = external
-                _save_external_ip(external)

            cfg = load_config()
            services = cfg.get("services", [])
@@ -43,6 +43,11 @@ function renderDomainNeedsHtml(opts) {
      + '<a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">Njal.la</a>'
      + " and connecting your services. Just follow the steps below.</p>";
  }
+  // Every variant above ends with a domain that points at the user's home
+  // connection. Say what that publishes (README: "Server + Desktop and your
+  // home IP address").
+  html += "<p>⚠️ <strong>Heads-up:</strong> your domain points at your home internet connection, "
+    + "so anyone can look up your home IP address. Domain privacy does not hide it.</p>";
  return html;
 }

@@ -476,6 +476,10 @@
            <li>To make your services available outside your home, complete one router task: forward ports <strong>80 and 443</strong> to this computer</li>
          </ul>
        </div>
+        <p class="support-desc">
+          ⚠️ <strong>Heads-up:</strong> your domain points at your home internet connection,
+          so anyone can look up your home IP address. Domain privacy does not hide it.
+        </p>
        <p class="support-desc">
          The Hub guides you through every step.
        </p>
@@ -165,6 +165,14 @@
  programs.fish = { enable = true; promptInit = "fastfetch"; };

  # ── PostgreSQL base ────────────────────────────────────────
+  # Shared cluster for Nextcloud (nextclouddb) + Matrix Synapse.
+  # Sized for the README's Server + Desktop recommendation (32 GB RAM,
+  # 500 GB NVMe OS + 2 TB NVMe timechain). Postgres shares the box with
+  # Bitcoin Core, Electrs, LND, MariaDB, PHP-FPM and GNOME, so
+  # shared_buffers stays below the 25%-of-RAM dedicated-server rule.
+  # Fixes Nextcloud 35 Database checks (pg.cache_hit_ratio,
+  # pg.dead_tuples). Override in custom.nix for other hosts, e.g.:
+  #   services.postgresql.settings.shared_buffers = lib.mkForce "512MB";
  services.postgresql = {
    enable = true;
    authentication = lib.mkForce ''
@@ -172,6 +180,34 @@
      host    all   all   127.0.0.1/32  trust
      host    all   all   ::1/128       trust
    '';
+    settings = {
+      # Memory — fixes low buffer cache hit ratio (stock default is
+      # 128MB shared_buffers). effective_cache_size is only a planner
+      # hint, not an allocation, so it can be generous.
+      # NOTE: changing shared_buffers requires a Postgres restart.
+      shared_buffers = "2GB";
+      effective_cache_size = "12GB";
+      maintenance_work_mem = "512MB";
+      work_mem = "32MB";
+      wal_buffers = "64MB";
+
+      # Checkpoints — spread write bursts out on NVMe. Reload-only.
+      min_wal_size = "1GB";
+      max_wal_size = "4GB";
+      checkpoint_completion_target = 0.9;
+
+      # Autovacuum — the stock 60s naptime can't keep up with
+      # Nextcloud's and Synapse's write-heavy tables (filecache,
+      # activity, jobs, state). Reload-only.
+      autovacuum_naptime = "30s";
+      autovacuum_vacuum_scale_factor = 0.05;
+      autovacuum_analyze_scale_factor = 0.025;
+      autovacuum_max_workers = 4;
+
+      # NVMe planner assumptions (README: NVMe OS + data disks).
+      random_page_cost = "1.1";
+      effective_io_concurrency = 200;
+    };
  };

  # ── Backups ────────────────────────────────────────────────
@@ -5,11 +5,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1788871704,
-        "narHash": "sha256-Vtc2SqCB7NOO028+K5JHbpWQ3XVpLyoC75MZQ12l13o=",
+        "lastModified": 1790862821,
+        "narHash": "sha256-IcLn2hPlxsbn2PKVlFD6gsDzkVurQ7b0KPtyORUGFcs=",
        "owner": "emmanuelrosa",
        "repo": "btc-clients-nix",
-        "rev": "e14502cba22806341f8c54c6f0c349094830c58b",
+        "rev": "99b0442dcc15198efcb62f3c1e7561a361749a6a",
        "type": "github"
      },
      "original": {
@@ -26,11 +26,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -41,11 +41,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1788179970,
-        "narHash": "sha256-r5LmxzIhsu5+oDybatN/HJ8roYOKjb2Apa5xI6v46VU=",
-        "owner": "NixOS",
+        "lastModified": 1790861130,
+        "narHash": "sha256-cA8TrQntLbNO14wivJx7Gi2pZBhhBcMplgzIA3sk3TA=",
+        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "1db62ab7d2ccf1916bbf7deb61fc9d16f1c4ab49",
+        "rev": "3d23ea05a8a3be3f078845c2753af10cef80e1a5",
        "type": "github"
      },
      "original": {
@@ -56,27 +56,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1788921488,
-        "narHash": "sha256-8+xWRxEkD6l217cIUdRxfeUGS9lQX0hVtUuNVsBaDzk=",
+        "lastModified": 1790750587,
+        "narHash": "sha256-VfjaoJ1Uyb7JZTrBgE5Jf2nhjtQPmD9KOd19HJwmZwM=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6aefcda9401be8acc2b74244fb3b37520ea1f0a8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1788807765,
-        "narHash": "sha256-J9oC0bKnkXUrMegqRTXVkyDFJ0gn2U/Qpoo9HgGMQmA=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "93108a538f079596c9a16c72cf03e9322782b6dd",
+        "rev": "78e9c786dc08cd4f3420c2395cd977206a9b1da2",
        "type": "github"
      },
      "original": {
@@ -88,11 +72,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1788881743,
-        "narHash": "sha256-2V9GZGvPfrNzxFozhI9dcqV+c3QdA8YZrvAAzqEB+dI=",
+        "lastModified": 1790822859,
+        "narHash": "sha256-69xHQhAeMAD2wDXO7T2pcOZIF9Sga2W+JkmY2a11Ops=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d6524aaca2ff07876657ae2b323f24be4874944b",
+        "rev": "c59305bab2065cfecc4944690d9eedbb56f3a9fa",
        "type": "github"
      },
      "original": {
@@ -104,11 +88,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1787631388,
-        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
+        "lastModified": 1789724158,
+        "narHash": "sha256-nlKgrm0dsVhOSopKheVBCcOpiIticufPPVLdVOI0euA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
+        "rev": "0a3468a402c449992505b6a9fc5b06580141b750",
        "type": "github"
      },
      "original": {
@@ -120,11 +104,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1788881743,
-        "narHash": "sha256-2V9GZGvPfrNzxFozhI9dcqV+c3QdA8YZrvAAzqEB+dI=",
+        "lastModified": 1790822859,
+        "narHash": "sha256-69xHQhAeMAD2wDXO7T2pcOZIF9Sga2W+JkmY2a11Ops=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d6524aaca2ff07876657ae2b323f24be4874944b",
+        "rev": "c59305bab2065cfecc4944690d9eedbb56f3a9fa",
        "type": "github"
      },
      "original": {
@@ -141,11 +125,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1788190018,
-        "narHash": "sha256-59BAfH0txPAZrPBF4QJqwvUWppD+ICrcjA1LZAmPnrQ=",
+        "lastModified": 1790541651,
+        "narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "41844750e55f17b1385d5b09ca7ade5f11f49506",
+        "rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
        "type": "github"
      },
      "original": {
@@ -165,15 +149,14 @@
    },
    "sovran-bitcoin": {
      "inputs": {
-        "nixpkgs": "nixpkgs_4",
-        "nixpkgs-stable": "nixpkgs-stable_2"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1788921077,
-        "narHash": "sha256-k2i55M0lK3xzjsJKS/kOhQHSf8479r6RYEllnICxggg=",
+        "lastModified": 1790877969,
+        "narHash": "sha256-Ia88keP9t3B6ECVw+LP4xasPdvzw1TIWya1K+3dySu0=",
        "owner": "naturallaw777",
        "repo": "Sovran_Bitcoin",
-        "rev": "7c4d5b509c0533ea48192146f987182668bf42dc",
+        "rev": "b0da63bd81f1a1b1a970068b3061c6c8389db9aa",
        "type": "github"
      },
      "original": {
@@ -6,8 +6,6 @@
 		nixvim.url = "github:nix-community/nixvim";
 		btc-clients.url = "github:emmanuelrosa/btc-clients-nix";
 		nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
-
-		# Bitcoin / Lightning stack — standalone flake, consumed as a module.
 		sovran-bitcoin.url = "github:naturallaw777/Sovran_Bitcoin";
 	};

@@ -19,24 +17,6 @@
 				system = prev.stdenv.hostPlatform.system;
 				config.allowUnfree = true;
 			};
-
-			# Pin LiveKit to 1.13.6: element-calling.nix sets
-			# rtc.advertise_internal_ip, which gives LAN callers a host candidate
-			# so calls work on Wi-Fi without the router needing NAT-hairpin. That
-			# flag is only honoured when node_ip is set manually from LiveKit
-			# v1.13.6 (mediatransportutil f234b53); nixpkgs-unstable currently
-			# ships 1.13.5. Remove this override once nixpkgs-unstable reaches
-			# >= 1.13.6.
-			livekit = prev.livekit.overrideAttrs (old: {
-				version = "1.13.6";
-				src = prev.fetchFromGitHub {
-					owner = "livekit";
-					repo = "livekit";
-					rev = "v1.13.6";
-					hash = "sha256-sUAx6ooeEUUqot5xuZv7xiQa3DdRFVULteTwYgFUzCI=";
-				};
-				vendorHash = "sha256-nOGSmoNuQQm/sIVI1HojsiS4GkbhA68uYMQ6X7d4a5Q=";
-			});
 		};
 	in
 	{
@@ -77,14 +57,5 @@
 				];
 			};
 		};
-
-		checks.x86_64-linux = let
-			pkgs = import nixpkgs {
-				system = "x86_64-linux";
-			};
-		in {
-			# Bitcoin hardening and package checks now live in the Sovran_Bitcoin flake.
-			# Run them with: nix build github:naturallaw777/Sovran_Bitcoin#checks.x86_64-linux
-		};
 	};
 }
@@ -471,7 +471,7 @@ class InstallerWindow(Adw.ApplicationWindow):
        # Role cards
        roles = [
            ("Server + Desktop",
-             "Full sovereignty: host your own websites, cloud, chat, passwords, and Bitcoin services instead of relying on Big Tech. Sovran_SystemsOS walks you through getting your domain from Njal.la and connecting everything. One router task is required: forward ports 80 and 443 to this computer.",
+             "Full sovereignty: host your own websites, cloud, chat, passwords, and Bitcoin services instead of relying on Big Tech. Sovran_SystemsOS walks you through getting your domain from Njal.la and connecting everything. One router task is required: forward ports 80 and 443 to this computer. Heads-up: this makes your home IP address public.",
             "Server+Desktop"),
            ("Desktop Only",
             "A beautiful, easy-to-use desktop without the background server applications.",
@@ -89,6 +89,26 @@ EOF
 EOF
      ''}

+      # ── LAN-only guard ──────────────────────────────
+      # The Hub, RTL and Mempool sites below are meant for this home network
+      # only. Forwarding ports 80/443 on the router also lets other clients
+      # reach Caddy, so these sites check where a request comes from, not just
+      # which Host it asks for. Anyone else gets the connection closed.
+      #   private_ranges   10/8, 172.16/12, 192.168/16, 127/8, fd00::/8, ::1
+      #   100.64.0.0/10    Tailscale and other VPN addresses
+      #   169.254.0.0/16, fe80::/10, fc00::/7   link-local and unique-local
+      #   2000::/3         IPv6 global addresses. Computers on this network
+      #                    often connect over their own global address, which
+      #                    looks the same as one from the internet, so IPv6
+      #                    global addresses are not filtered.
+      cat >> /run/caddy/Caddyfile <<'EOF'
+
+(sovran_lan_only) {
+  @outside not remote_ip private_ranges 100.64.0.0/10 169.254.0.0/16 fe80::/10 fc00::/7 2000::/3
+  abort @outside
+}
+EOF
+
      # ── Matrix ──────────────────────────────────────
      if [ -n "$MATRIX" ]; then
        if [ -f /run/caddy/element-calling.snippet ]; then
@@ -206,6 +226,7 @@ EOF
      cat >> /run/caddy/Caddyfile <<EOF

 http://sovransystemsos.local {
+  import sovran_lan_only
  reverse_proxy localhost:8937
  header {
    Clear-Site-Data "\"cache\""
@@ -220,6 +241,7 @@ EOF
      cat >> /run/caddy/Caddyfile <<EOF

 :3051 {
+  import sovran_lan_only
  reverse_proxy :3050
  encode gzip zstd
 }
@@ -229,6 +251,7 @@ EOF
      cat >> /run/caddy/Caddyfile <<EOF

 :60847 {
+  import sovran_lan_only
  reverse_proxy :60845
  encode gzip zstd
 }
@@ -1,43 +1,64 @@
 { config, pkgs, lib, ... }:

 {
+  # The public-IP detector (STUN / OpenDNS / HTTPS echo) is gone: the public
+  # address is whatever Njal.la reports back for the DDNS update below, and
+  # nothing else on the system looks it up. Fail with a pointer, instead of
+  # silently ignoring them, if a custom.nix still sets one of its old options.
+  imports = map (opt:
+    lib.mkRemovedOptionModule [ "sovran_systemsOS" "publicIP" opt ]
+      "Sovran no longer looks up the public IP: the Njal.la DDNS update reports it (modules/core/njalla.nix). To force an address for Element Calling, set sovran_systemsOS.elementCalling.externalIP."
+  ) [ "stunServer" "stunPort" "dnsResolver" "httpsEcho" "cacheTTL" ];
+
  # ── Ensure njalla directory exists on every build ────────────────────────
  systemd.tmpfiles.rules = [
    "d /var/lib/njalla 0750 root root -"
  ];

-  # ── Install the shared validation helper so the DDNS runner can import it ─
-  # The exact same _validate_ddns_url() function used by the Hub web application
-  # is installed here as a read-only system file.  The DDNS runner imports it
-  # directly so the two code paths share one validator — no weaker inline copy.
+  # ── Install the DDNS runner and the validator it shares with the Hub ─────
+  # Both files come straight from the Hub's source tree and are installed side
+  # by side as read-only system files. The runner imports the exact same
+  # _validate_ddns_url() the Hub API uses — no weaker inline copy.
  environment.etc."sovran/security_helpers.py" = {
    source = ../../app/sovran_systemsos_web/security_helpers.py;
    mode   = "0444";
    user   = "root";
    group  = "root";
  };
+  environment.etc."sovran/ddns-update.py" = {
+    source = ../../app/sovran_systemsos_web/ddns_update.py;
+    mode   = "0444";
+    user   = "root";
+    group  = "root";
+  };

  # ── Safe DDNS update service ─────────────────────────────────────────────
  # Reads DDNS update URLs from the JSON store written by the Hub API and
  # invokes curl directly — no shell interpolation, no script execution.
-  # Replaces the legacy root cron job that ran /var/lib/njalla/njalla.sh.
+  # Njal.la is asked to use the address the request came from ("&auto") and
+  # reports it back; the runner saves it to /var/lib/secrets/external-ip,
+  # where LiveKit and the Hub read it. See app/sovran_systemsos_web/ddns_update.py.
  systemd.services.sovran-ddns-update = {
    description = "Sovran Njal.la DDNS update (safe JSON-based runner)";
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
+    # curl is not in a NixOS unit's default PATH (coreutils, findutils, grep,
+    # sed, systemd): without this the runner cannot start it.
+    path = [ pkgs.curl ];
    serviceConfig = {
      Type        = "oneshot";
      User        = "root";
-      ExecStart   = "${pkgs.python3}/bin/python3 /var/lib/sovran/ddns-update.py";
-      # Harden the service — it only needs network access and read access to
-      # /var/lib/njalla/ddns_urls.json.
+      ExecStart   = "${pkgs.python3}/bin/python3 /etc/sovran/ddns-update.py";
+      # Harden the service — it needs network access, the URL store, and the
+      # file that receives the reported address.
      NoNewPrivileges    = true;
      ProtectSystem      = "strict";
      ReadWritePaths     = [ "/var/lib/njalla" "/var/lib/secrets" ];
      ReadOnlyPaths      = [ "/etc/sovran" ];
      ProtectHome        = true;
      PrivateTmp         = true;
-      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      # AF_UNIX: name lookups can go through nscd / systemd-resolved sockets.
+      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
    };
  };

@@ -52,86 +73,9 @@
    };
  };

-  # Install the Python runner script at build time so the service can find it.
-  # The script is owned by root and not world-writable.
-  # Uses _validate_ddns_url() from /etc/sovran/security_helpers.py — the same
-  # production validator used by the Hub API — before executing any curl call.
-  # No shell is used; no redirects; no script execution.
-  # ${IP} placeholder is preserved in stored URLs and substituted at runtime;
-  # the URL is validated after substitution so any remaining $ is rejected.
+  # The runner used to be written to /var/lib/sovran by this activation script,
+  # next to the old public-ip.py detector. Remove those stale copies.
  system.activationScripts.sovran-ddns-update-script = ''
-    install -d -m 0755 /var/lib/sovran
-    cat > /var/lib/sovran/ddns-update.py <<'PYEOF'
-#!/usr/bin/env python3
-"""Sovran safe DDNS update runner.
-
-Reads ddns_urls.json, substitutes the public IP for the ''${IP} placeholder,
-validates each URL using the production _validate_ddns_url() from
-/etc/sovran/security_helpers.py, then calls curl per URL.
-No shell interpolation.  No redirects.  No script execution.
-"""
-import ipaddress, json, os, subprocess, sys
-
-sys.path.insert(0, '/etc/sovran')
-try:
-    from security_helpers import _validate_ddns_url
-except ImportError:
-    sys.exit(1)  # validator missing — fail so systemd logs the misconfiguration
-
-URLS_FILE = "/var/lib/njalla/ddns_urls.json"
-
-try:
-    with open(URLS_FILE) as f:
-        urls = json.load(f)
-    if not isinstance(urls, list):
-        raise ValueError("not a list")
-except Exception:
-    sys.exit(0)  # no URLs configured — nothing to do
-
-# Resolve current public IP via the shared detector — one script, one cache
-# (STUN -> DNS -> opt-in HTTPS echo; see /var/lib/sovran/public-ip.py).
-# The detector refreshes /var/lib/secrets/external-ip, which the Hub and
-# LiveKit read as well, so the whole system shares a single detected value.
-public_ip = ""
-try:
-    r = subprocess.run(
-        [sys.executable, "/var/lib/sovran/public-ip.py", "check"],
-        capture_output=True, text=True, timeout=20,
-    )
-    raw = r.stdout.strip().splitlines()[0] if r.stdout.strip() else ""
-    ipaddress.ip_address(raw)  # validates — raises if not a real IP
-    public_ip = raw
-except Exception:
-    pass
-
-if not public_ip:
-    # Last resort: the shared cache file, if the detector is unavailable.
-    try:
-        with open("/var/lib/secrets/external-ip") as f:
-            raw = f.read().strip()
-        ipaddress.ip_address(raw)
-        public_ip = raw
-    except Exception:
-        pass
-
-if not public_ip:
-    sys.exit(0)  # no IP resolved — skip to avoid sending bare ''${IP}
-
-for raw_url in urls:
-    try:
-        # Substitute ''${IP} placeholder then validate through production validator.
-        # After substitution there must be no $ left; _validate_ddns_url rejects
-        # any remaining $ expression.
-        url = raw_url.replace("''${IP}", public_ip)
-        _validate_ddns_url(url)
-        subprocess.run(
-            ["curl", "--silent", "--max-time", "15", "--fail", "--no-location", url],
-            timeout=20, check=False,
-            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-        )
-    except Exception:
-        pass
-PYEOF
-    chmod 0500 /var/lib/sovran/ddns-update.py
+    rm -f /var/lib/sovran/ddns-update.py /var/lib/sovran/public-ip.py
  '';
 }
@@ -1,323 +0,0 @@
-# ── Unified public-IP detection (privacy-first) ─────────────────────────────
-#
-# One script, one cache file, every consumer on the system reads the same
-# value. Previously the public IP was detected independently in three places,
-# each phoning home to a different third party:
-#   * the Hub (server.py _get_external_ip) → api.ipify.org / ifconfig.me /
-#     icanhazip.com over HTTPS on every /api/network call and every
-#     background-loop tick
-#   * DDNS (ddns-update.py) → myip.opendns.com via OpenDNS
-#   * LiveKit → STUN (its own embedded detection)
-#
-# This module replaces all of that with a single script
-# (/var/lib/sovran/public-ip.py) that detects the IP once per TTL using the
-# least-exposing mechanism available, and caches it in
-# /var/lib/secrets/external-ip. Consumers (Hub, DDNS, LiveKit) read the cache
-# and only invoke the script when it is missing or stale.
-#
-# Detection chain (first success wins, stops immediately):
-#   1. pin         — sovran_systemsOS.elementCalling.externalIP (baked in)
-#   2. cache       — /var/lib/secrets/external-ip if newer than cacheTTL
-#   3. STUN        — UDP binding request (one packet, no application data,
-#                    no HTTP metadata; the same protocol every WebRTC client
-#                    uses). Server configurable via publicIP.stunServer.
-#   4. DNS         — "myip.opendns.com" A query via publicIP.dnsResolver
-#                    (single DNS query, no HTTP headers)
-#   5. HTTPS echo  — ONLY endpoints listed in publicIP.httpsEcho (empty by
-#                    default → never contacted)
-#
-# Privacy property: while the cache is fresh, zero third parties are
-# contacted. When detection runs, at most ONE party learns the IP per
-# refresh interval (default 5 minutes), and the STUN/DNS mechanisms expose
-# nothing beyond the bare address.
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  stunServer  = config.sovran_systemsOS.publicIP.stunServer;
-  stunPort    = config.sovran_systemsOS.publicIP.stunPort;
-  dnsResolver = config.sovran_systemsOS.publicIP.dnsResolver;
-  httpsEcho   = config.sovran_systemsOS.publicIP.httpsEcho;
-  cacheTTL    = config.sovran_systemsOS.publicIP.cacheTTL;
-
-  # Optional pin shared with element-calling (baked in at build time).
-  pin = if config.sovran_systemsOS.elementCalling.externalIP != null then config.sovran_systemsOS.elementCalling.externalIP else "";
-
-  echoList = lib.concatStringsSep "," (map (u: "'${u}'") httpsEcho);
-in
-{
-  options.sovran_systemsOS.publicIP = {
-    stunServer = lib.mkOption {
-      type = lib.types.str;
-      default = "stun.l.google.com";
-      description = ''
-        STUN server used to discover the public IP over UDP. STUN is the most
-        privacy-preserving detection mechanism: a single stateless packet,
-        no HTTP metadata. Only used when the cache is stale.
-      '';
-    };
-    stunPort = lib.mkOption {
-      type = lib.types.port;
-      default = 19302;
-    };
-    dnsResolver = lib.mkOption {
-      type = lib.types.str;
-      default = "resolver4.opendns.com";
-      description = ''
-        DNS resolver used as fallback (myip.opendns.com trick) when STUN is
-        unavailable (e.g. ISP blocks UDP egress). A single DNS query, no
-        HTTP headers.
-      '';
-    };
-    httpsEcho = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [ "https://api.ipify.org" ];
-      description = ''
-        OPT-IN HTTPS endpoints that return the caller's public IP as a bare
-        IPv4 literal. Each listed endpoint observes this server's public IP
-        and HTTP metadata every time detection runs. Empty by default — no
-        HTTPS echo service is ever contacted unless you add one here. This is
-        the last-resort fallback after STUN and DNS.
-      '';
-    };
-    cacheTTL = lib.mkOption {
-      type = lib.types.int;
-      default = 300;
-      description = "Seconds the detected public IP is cached before re-detection.";
-    };
-  };
-
-  # ── Install the unified detector ──────────────────────────────────────────
-  # This module declares `options` above, so ALL configuration must go under
-  # the `config` attribute: NixOS forbids mixing bare top-level settings
-  # (like `system.*`) with the `options`/`config` keyword attributes in the
-  # same module. (Fixes: "Module ... has an unsupported attribute `system'".)
-  config.system.activationScripts.sovranPublicIpInstall = lib.stringAfter [ "users" ] ''
-    install -d -m 0755 /var/lib/sovran
-    cat > /var/lib/sovran/public-ip.py <<'PYEOF'
-#!/usr/bin/env python3
-"""sovran-public-ip — one detector, one cache, every consumer reads the same IP.
-
-Privacy-first detection chain (first success wins):
-  1. pin     — baked in from sovran_systemsOS.elementCalling.externalIP
-  2. cache   — /var/lib/secrets/external-ip if newer than CACHE_TTL seconds
-  3. STUN    — UDP binding request (one packet, no application data)
-  4. DNS     — myip.opendns.com A query via the configured resolver
-  5. HTTPS   — ONLY endpoints baked in from publicIP.httpsEcho (opt-in)
-
-Usage:
-  public-ip.py check     print current public IP (cache first; refresh if stale)
-  public-ip.py refresh   force re-detection, update the cache file, print IP
-
-Exit status: 0 with the IP on stdout on success; 1 if no IP is available
-(cached value, if any, is still printed to stdout with a warning on stderr).
-"""
-import ipaddress
-import os
-import random
-import socket
-import struct
-import sys
-import time
-import urllib.request
-
-CACHE_FILE = "/var/lib/secrets/external-ip"
-PIN        = "${pin}"
-STUN_SERVER = "${stunServer}"
-STUN_PORT   = ${toString stunPort}
-DNS_RESOLVER = "${dnsResolver}"
-DNS_HOST     = "myip.opendns.com"
-ECHO_URLS    = [ ${echoList} ]
-CACHE_TTL    = ${toString cacheTTL}
-TIMEOUT      = 3.0
-
-# ---------------------------------------------------------------------------
-# Detection primitives
-# ---------------------------------------------------------------------------
-
-def is_usable_ip(text: str) -> bool:
-    """True if text is a globally routable IPv4 that LiveKit may advertise."""
-    try:
-        ip = ipaddress.ip_address(text)
-    except ValueError:
-        return False
-    if ip.version != 4:
-        return False
-    if (ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_multicast
-            or ip.is_reserved or ip.is_unspecified or not ip.is_global):
-        return False
-    # RFC 6598 shared (CGNAT) space — not reachable from the internet.
-    if ip in ipaddress.ip_network("100.64.0.0/10"):
-        return False
-    return True
-
-
-def stun_public_ip() -> str | None:
-    """RFC 5389 Binding request over UDP; returns the mapped (public) IPv4."""
-    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-    sock.settimeout(TIMEOUT)
-    try:
-        txid = random.randbytes(12)
-        req = struct.pack("!HHI", 0x0001, 0, 0) + txid  # Binding request
-        sock.sendto(req, (STUN_SERVER, STUN_PORT))
-        data, _ = sock.recvfrom(2048)
-    except OSError:
-        return None
-    finally:
-        sock.close()
-
-    if len(data) < 20:
-        return None
-    mtype, _mlen = struct.unpack("!HH", data[:4])
-    if mtype != 0x0101:  # Binding success response
-        return None
-
-    cookie = data[4:8]
-    i = 20
-    while i + 4 <= len(data):
-        atype, alen = struct.unpack("!HH", data[i : i + 4])
-        aval = data[i + 4 : i + 4 + alen]
-        if atype in (0x0001, 0x0020) and len(aval) >= 8:  # MAPPED / XOR-MAPPED
-            family = aval[1]
-            if family == 0x01:  # IPv4
-                raw = aval[4:8]
-                if atype == 0x0020:  # XOR with magic cookie + txid prefix
-                    raw = bytes(b ^ c for b, c in zip(raw, cookie + txid[:4]))
-                return socket.inet_ntop(socket.AF_INET, raw)
-        i += 4 + ((alen + 3) // 4) * 4
-    return None
-
-
-def dns_public_ip() -> str | None:
-    """Minimal DNS A query for myip.opendns.com against the given resolver."""
-    qid = random.randint(0, 0xFFFF)
-    qname = b"".join(bytes([len(p)]) + p.encode() for p in DNS_HOST.split(".")) + b"\x00"
-    query = struct.pack("!HHHHHH", qid, 0x0100, 1, 0, 0, 0) + qname + struct.pack("!HH", 1, 1)
-    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-    sock.settimeout(TIMEOUT)
-    try:
-        sock.sendto(query, (DNS_RESOLVER, 53))
-        data, _ = sock.recvfrom(4096)
-    except OSError:
-        return None
-    finally:
-        sock.close()
-
-    try:
-        if len(data) < 12:
-            return None
-        rid, _flags, _qd, an, _ns, _ar = struct.unpack("!HHHHHH", data[:12])
-        if rid != qid or an == 0:
-            return None
-        i = 12
-        for _ in range(_qd):  # skip question
-            while data[i] != 0:
-                i += 1 + data[i]
-            i += 5
-        for _ in range(an):
-            if data[i] & 0xC0 == 0xC0:
-                i += 2
-            else:
-                while data[i] != 0:
-                    i += 1 + data[i]
-                i += 1
-            rtype, _rclass, _ttl, rdlen = struct.unpack("!HHIH", data[i : i + 10])
-            i += 10
-            if rtype == 1 and rdlen == 4:
-                return socket.inet_ntop(socket.AF_INET, data[i : i + 4])
-            i += rdlen
-    except (IndexError, struct.error):
-        return None
-    return None
-
-
-def echo_public_ip() -> str | None:
-    """Opt-in HTTPS echo endpoints (baked in at build time; empty by default)."""
-    for url in ECHO_URLS:
-        try:
-            req = urllib.request.Request(url, headers={"User-Agent": "sovran-public-ip"})
-            with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
-                text = resp.read().decode().strip()
-            if is_usable_ip(text):
-                return text
-        except Exception:
-            continue
-    return None
-
-
-# ---------------------------------------------------------------------------
-# Cache handling
-# ---------------------------------------------------------------------------
-
-def read_cache() -> str:
-    try:
-        with open(CACHE_FILE) as f:
-            return f.read().strip()
-    except OSError:
-        return ""
-
-
-def write_cache(ip: str) -> None:
-    try:
-        os.makedirs(os.path.dirname(CACHE_FILE), exist_ok=True)
-        tmp = f"{CACHE_FILE}.tmp"
-        with open(tmp, "w") as f:
-            f.write(ip + "\n")
-        os.replace(tmp, CACHE_FILE)
-    except OSError:
-        pass
-
-
-def cache_fresh() -> bool:
-    try:
-        return time.time() - os.path.getmtime(CACHE_FILE) < CACHE_TTL
-    except OSError:
-        return False
-
-
-def detect() -> str:
-    """Run the chain; returns usable IP or an empty string."""
-    if PIN and is_usable_ip(PIN):
-        return PIN
-    for fn in (stun_public_ip, dns_public_ip, echo_public_ip):
-        try:
-            cand = fn()
-        except Exception:
-            continue
-        if cand and is_usable_ip(cand):
-            return cand
-    return ""
-
-
-def main() -> int:
-    force = len(sys.argv) > 1 and sys.argv[1] == "refresh"
-    ip = ""
-    if not force and cache_fresh():
-        ip = read_cache()
-    if not ip:
-        ip = detect()
-        if ip:
-            write_cache(ip)
-        else:
-            stale = read_cache()
-            if stale:
-                print(stale)
-                print("WARNING: detection failed; using last known public IP", file=sys.stderr)
-                return 0
-            print("ERROR: could not determine a public IP (STUN/DNS unreachable)", file=sys.stderr)
-            return 1
-    print(ip)
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
-PYEOF
-    chmod 0555 /var/lib/sovran/public-ip.py
-  '';
-}
@@ -107,9 +107,11 @@
        description = ''
          Optional pin: force LiveKit to advertise this public IPv4 in its
          host/TURN ICE candidates. Not required in normal operation — the
-          module auto-detects the public IP at runtime (HTTPS egress
-          detection, falling back to STUN). Set it only to override a
-          mis-detected address (e.g. multi-WAN/VPN setups).
+          address is the one Njal.la reports for the DDNS update (set up in
+          the Hub's Domains page), and nothing on this system looks it up
+          anywhere else. Set it for a fixed public address with no Njal.la
+          DDNS entry, or to override the reported one (e.g. multi-WAN/VPN
+          setups).
        '';
      };
    };
@@ -204,34 +204,36 @@ EOF
      # NAT with port-forwarding. It does not need to be assigned to this box,
      # and it may be dynamic.
      #
-      # Reuse the shared detector (/var/lib/sovran/public-ip.py — see
-      # modules/core/public-ip.nix) instead of running our own: one script,
-      # one cache, privacy-first (STUN -> DNS -> opt-in HTTPS echo). Priority:
+      # Nothing here looks the address up. Priority:
      #   1. sovran_systemsOS.elementCalling.externalIP (explicit pin, if set)
-      #   2. /var/lib/secrets/external-ip (the shared cache)
-      #   3. run the detector now (it refreshes the cache)
-      #   4. STUN auto-detection (use_external_ip) as the fallback, with a
-      #      warning — this is where broken installs used to silently end up
-      #      advertising a private IP, causing "call connects but no video".
+      #   2. /var/lib/secrets/external-ip — the address Njal.la reported for the
+      #      last DDNS update (modules/core/njalla.nix). The runner rewrites that
+      #      file only when the address changes, and livekit-external-ip.path
+      #      then re-runs this script.
+      # With neither, or with an address that is not public, this unit fails with
+      # a clear message instead of guessing: advertising a wrong or private
+      # address is what produces "call connects but no video".
      EXTERNAL_IP='${if config.sovran_systemsOS.elementCalling.externalIP != null then config.sovran_systemsOS.elementCalling.externalIP else ""}'

      PUBLIC_IP="$EXTERNAL_IP"
      if [ -z "$PUBLIC_IP" ] && [ -f /var/lib/secrets/external-ip ]; then
        PUBLIC_IP=$(tr -d '[:space:]' < /var/lib/secrets/external-ip 2>/dev/null)
      fi
-      if [ -z "$PUBLIC_IP" ] && [ -x /var/lib/sovran/public-ip.py ]; then
-        PUBLIC_IP=$(python3 /var/lib/sovran/public-ip.py check 2>/dev/null | head -n1)
+
+      if [ -z "$PUBLIC_IP" ]; then
+        echo "ERROR: no public IP is known for LiveKit yet." >&2
+        echo "ERROR: It is recorded after the first successful Njal.la DDNS update (Hub, Domains)." >&2
+        echo "ERROR: To use a fixed address instead, set sovran_systemsOS.elementCalling.externalIP." >&2
+        exit 1
      fi

      # Reject non-routable addresses (loopback, private, link-local, CGNAT).
-      # A detected/pinned address like this must never be advertised.
-      if [ -n "$PUBLIC_IP" ] && printf '%s' "$PUBLIC_IP" | grep -qE \
-        '^(0\.|127\.|10\.|100\.64\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'; then
-        echo "WARNING: external IP '$PUBLIC_IP' is not routable; falling back to STUN auto-detection." >&2
-        PUBLIC_IP=""
+      if printf '%s' "$PUBLIC_IP" | grep -qE \
+        '^(0\.|127\.|10\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'; then
+        echo "ERROR: $PUBLIC_IP is not a public address, so remote peers cannot reach LiveKit there." >&2
+        exit 1
      fi

-      if [ -n "$PUBLIC_IP" ]; then
      cat > /run/livekit/livekit.yaml <<EOF
 port: 7880
 rtc:
@@ -245,21 +247,6 @@ rtc:
      - $IFACE
 EOF
      echo "LiveKit will advertise public IP: $PUBLIC_IP"
-      else
-        cat > /run/livekit/livekit.yaml <<EOF
-port: 7880
-rtc:
-  use_external_ip: true
-  skip_external_ip_validation: true
-  advertise_internal_ip: true
-  tcp_port: 7881
-  udp_port: 7882
-  interfaces:
-    includes:
-      - $IFACE
-EOF
-        echo "WARNING: could not determine a public IP for LiveKit; using STUN auto-detection. If calls connect without media, check STUN egress or set sovran_systemsOS.elementCalling.externalIP." >&2
-      fi

      # Webhooks → lk-jwt-service. The JWT service validates the HMAC
      # signature against the same key file it issues tokens with, and uses
@@ -414,15 +401,32 @@ EOF
  # Restart LiveKit / lk-jwt-service when a rebuild regenerates their runtime
  # configs (new domains, externalIP, full-access list), mirroring the domain
  # change flow.
-  # Re-run the config generator and restart LiveKit when a rebuild regenerates
-  # the runtime config, or when the Hub persists a new external IP (dynamic
-  # WAN IPs), so the advertised ICE candidate stays current without a manual
-  # restart. The trigger chain: external-ip change → livekit-turn-setup
-  # re-runs → rewrites livekit.yaml → livekit restarts with the new config.
-  systemd.services.livekit-turn-setup.restartTriggers = [ "/var/lib/secrets/external-ip" ];
  systemd.services.livekit.restartTriggers = [ "/run/livekit/livekit.yaml" ];
  systemd.services.lk-jwt-service.restartTriggers = [ "/run/lk-jwt-service/env" ];

+  # Follow a changing public IP. ddns-update.py rewrites
+  # /var/lib/secrets/external-ip only when Njal.la reports a different address;
+  # this path unit then re-runs livekit-turn-setup (new node_ip and TURN
+  # address) and starts LiveKit if it is not running, e.g. because no address
+  # was known yet at boot. restartTriggers cannot do this: it is evaluated when
+  # the system is built, so it cannot watch a file that changes at runtime.
+  systemd.paths.livekit-external-ip = {
+    description = "Watch the public IP recorded by the Njal.la DDNS runner";
+    wantedBy = [ "multi-user.target" ];
+    pathConfig.PathChanged = "/var/lib/secrets/external-ip";
+  };
+  systemd.services.livekit-external-ip = {
+    description = "Re-run LiveKit setup for a changed public IP";
+    serviceConfig.Type = "oneshot";
+    unitConfig.ConditionPathExists = "/var/lib/domains/element-calling";
+    script = ''
+      # livekit.service requires livekit-turn-setup, so it restarts with it.
+      systemctl restart livekit-turn-setup.service
+      # No-op if LiveKit is already running; starts it after an earlier failure.
+      systemctl start livekit.service
+    '';
+  };
+
  ####### PUBLIC REACHABILITY SELF-CHECK #######
  # Diagnostic only — never a hard dependency of livekit/caddy. Catches the
  # classic "call connects but no media" setup errors at boot instead of at
@@ -17,7 +17,6 @@
    ./core/no-sleep.nix
    ./core/cpu-performance.nix
    ./core/local-domain-loopback.nix
-    ./core/public-ip.nix

    # ── Always on (no flag) ───────────────────────────────────
    ./php.nix
@@ -3,10 +3,22 @@
 lib.mkIf config.sovran_systemsOS.services.nextcloud {

  # ── PostgreSQL database ───────────────────────────────────
+  # Cluster-wide tuning (shared_buffers, autovacuum) lives in
+  # configuration.nix so it is shared with Matrix Synapse.
  services.postgresql = {
    enable = true;
  };

+  # ── Redis for Nextcloud distributed cache + file locking ───
+  # Nextcloud does not recommend APCu for memcache.locking in production.
+  # TCP on localhost avoids unix-socket permission juggling with the caddy user.
+  # Scoped to Nextcloud only — Synapse / MariaDB / Bitcoin are unaffected.
+  services.redis.servers.nextcloud = {
+    enable = true;
+    bind = "127.0.0.1";
+    port = 6379;
+  };
+
  # ── Auto-generate DB password and initialize ──────────────
  systemd.services.nextcloud-db-init = {
    description = "Initialize Nextcloud PostgreSQL database with auto-generated password";
@@ -47,14 +59,20 @@ lib.mkIf config.sovran_systemsOS.services.nextcloud {
      if ! psql -U postgres -lqt | cut -d \| -f 1 | grep -qw "nextclouddb"; then
        psql -U postgres -c "CREATE DATABASE nextclouddb WITH OWNER ncusr TEMPLATE template0 LC_COLLATE = 'C' LC_CTYPE = 'C';"
      fi
+
+      # NOTE: autovacuum GUCs are SIGHUP-context, so they cannot be set
+      # per-database — ALTER DATABASE ... SET rejects them with
+      # 'parameter "..." cannot be changed now'. They are set
+      # cluster-wide in configuration.nix instead, which already covers
+      # both nextclouddb and matrix-synapse.
    '';
  };

  # ── Fully automated Nextcloud setup ───────────────────────
  systemd.services.nextcloud-init = {
    description = "Download, extract, and fully configure Nextcloud";
-    after = [ "network-online.target" "postgresql.service" "phpfpm-nextcloud.service" "nextcloud-db-init.service" ];
-    wants = [ "network-online.target" ];
+    after = [ "network-online.target" "postgresql.service" "phpfpm-nextcloud.service" "nextcloud-db-init.service" "redis-nextcloud.service" ];
+    wants = [ "network-online.target" "redis-nextcloud.service" ];
    requires = [ "postgresql.service" "nextcloud-db-init.service" ];
    wantedBy = [ "multi-user.target" ];

@@ -150,7 +168,11 @@ lib.mkIf config.sovran_systemsOS.services.nextcloud {
        php $INSTALL_DIR/occ config:system:set default_phone_region --value='US'
        php $INSTALL_DIR/occ config:system:set maintenance_window_start --type=integer --value=1
        php $INSTALL_DIR/occ config:system:set memcache.local --value='\OC\Memcache\APCu'
-        php $INSTALL_DIR/occ config:system:set memcache.locking --value='\OC\Memcache\APCu'
+        php $INSTALL_DIR/occ config:system:set memcache.distributed --value='\OC\Memcache\Redis'
+        php $INSTALL_DIR/occ config:system:set memcache.locking --value='\OC\Memcache\Redis'
+        php $INSTALL_DIR/occ config:system:set redis host --value='127.0.0.1'
+        php $INSTALL_DIR/occ config:system:set redis port --type=integer --value=6379
+        php $INSTALL_DIR/occ config:system:set redis timeout --value='1.5'
        php $INSTALL_DIR/occ config:system:set server_id --value='$SERVER_ID'
        php $INSTALL_DIR/occ background:cron
      "
@@ -247,6 +269,93 @@ CREDS
    '';
  };

+  # ── Migrate existing installs to Redis locking ────────────
+  # nextcloud-init only runs on fresh installs (ConditionPathExists
+  # !config.php), so pre-existing / pre-Sovran installs would keep
+  # APCu locking forever. This one-shot is idempotent and safe to
+  # re-run on every boot — occ just overwrites the same values.
+  systemd.services.nextcloud-redis-migrate = {
+    description = "Point existing Nextcloud installs at Redis locking";
+    after = [ "postgresql.service" "redis-nextcloud.service" "phpfpm-nextcloud.service" ];
+    wants = [ "redis-nextcloud.service" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig = {
+      ConditionPathExists = [
+        "/var/lib/www/nextcloud/occ"
+        "/var/lib/www/nextcloud/config/config.php"
+      ];
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    path = with pkgs; [ coreutils shadow ];
+    script = ''
+      set -euo pipefail
+      INSTALL_DIR="/var/lib/www/nextcloud"
+      # Wait briefly for Redis (TCP localhost:6379).
+      for i in $(seq 1 15); do
+        if (echo > /dev/tcp/127.0.0.1/6379) >/dev/null 2>&1; then
+          break
+        fi
+        sleep 2
+      done
+      /run/wrappers/bin/su -s /bin/sh caddy -c "
+        php $INSTALL_DIR/occ config:system:set memcache.local --value='\OC\Memcache\APCu'
+        php $INSTALL_DIR/occ config:system:set memcache.distributed --value='\OC\Memcache\Redis'
+        php $INSTALL_DIR/occ config:system:set memcache.locking --value='\OC\Memcache\Redis'
+        php $INSTALL_DIR/occ config:system:set redis host --value='127.0.0.1'
+        php $INSTALL_DIR/occ config:system:set redis port --type=integer --value=6379
+        php $INSTALL_DIR/occ config:system:set redis timeout --value='1.5'
+      "
+    '';
+  };
+
+  # ── Recurring DB maintenance (Nextcloud 35 checks) ───────────
+  # nextcloud-init runs db:add-missing-indices exactly once. Upgrades
+  # (e.g. to NC35) and later app installs (Mail, Guests) add tables
+  # like oc_mail_tags / oc_guests_users that then seq-scan forever.
+  # Weekly: VACUUM ANALYZE (dead tuples) + backfill missing indices.
+  # Scoped to nextclouddb only — matrix-synapse is untouched.
+  systemd.services.nextcloud-db-maintenance = {
+    description = "Nextcloud DB maintenance: VACUUM + missing indices";
+    after = [ "postgresql.service" "redis-nextcloud.service" "phpfpm-nextcloud.service" ];
+    wants = [ "postgresql.service" ];
+    unitConfig = {
+      ConditionPathExists = [
+        "/var/lib/www/nextcloud/occ"
+        "/var/lib/www/nextcloud/config/config.php"
+      ];
+    };
+    serviceConfig = {
+      Type = "oneshot";
+    };
+    path = [ config.services.postgresql.package pkgs.coreutils pkgs.shadow ];
+    script = ''
+      set -euo pipefail
+      INSTALL_DIR="/var/lib/www/nextcloud"
+      echo "Vacuuming nextclouddb..."
+      psql -U postgres -d nextclouddb -c "VACUUM (ANALYZE);"
+      echo "Backfilling Nextcloud indices..."
+      /run/wrappers/bin/su -s /bin/sh caddy -c "
+        php $INSTALL_DIR/occ db:add-missing-indices
+        php $INSTALL_DIR/occ db:add-missing-columns
+        php $INSTALL_DIR/occ db:add-missing-primary-keys
+      "
+      echo "Nextcloud DB maintenance complete."
+    '';
+  };
+
+  systemd.timers.nextcloud-db-maintenance = {
+    description = "Weekly Nextcloud DB maintenance";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "Sun 03:30";
+      Persistent = true;
+      RandomizedDelaySec = "30m";
+    };
+  };
+
  services.cron.systemCronJobs = [
    "*/5 * * * * caddy /run/current-system/sw/bin/php -f /var/lib/www/nextcloud/cron.php"
  ];
@@ -1,29 +1,70 @@
 { config, pkgs, lib, ... }:

+# ── Shared PHP for Nextcloud + WordPress ──────────────────────────────────────
+#
+# One interpreter (with one extension set and one php.ini) is shared by the
+# phpfpm-nextcloud and phpfpm-wordpress pools, the Nextcloud cron job and the
+# occ / wp-cli helper scripts.  Every consumer must reference
+# config.sovran_systemsOS.phpPackage (or /run/current-system/sw/bin/php) so
+# that the CLI and the FPM pools always run the *same* PHP.
+#
+# Version policy (September 2026):
+#   • Nextcloud 35 supports PHP 8.3 / 8.4 / 8.5 and recommends 8.5.  Its setup
+#     check flags 8.3 as "deprecated since Nextcloud 35" and warns that
+#     Nextcloud 36 may require at least 8.4.
+#   • WordPress 6.9 / 7.0 fully support PHP 8.4 and 8.5.
+#   • PHP 8.3 has been security-only since 2025-12-31; PHP 8.4 leaves active
+#     support on 2026-12-31; PHP 8.5 is actively supported until 2027-12-31.
+#
+# To fall back to PHP 8.4 (nixpkgs' current default `pkgs.php`) change only
+# the `phpBase` line below.

 let
+	phpBase = pkgs.php85;
+
+	custom-php = phpBase.buildEnv {
+		# `enabled` is nixpkgs' default extension set.  It already contains every
+		# module Nextcloud lists as required or recommended (ctype, curl, dom,
+		# fileinfo, gd, intl, mbstring, openssl, posix, session, simplexml,
+		# xmlreader, xmlwriter, zip, zlib, pdo_pgsql, pdo_mysql, bcmath, gmp,
+		# exif, sodium, sysvsem, pcntl, ...).  OPcache is compiled into PHP >= 8.5
+		# and no longer appears as a separate extension.
+		extensions = { enabled, all }: enabled ++ (with all; [
+			bz2        # Nextcloud: bz2 archive support
+			apcu       # Nextcloud: memcache.local  (apc.enable_cli=1 below is mandatory for occ + cron)
+			redis      # Nextcloud: memcache.distributed / file locking once a Redis server is configured
+			imagick    # Nextcloud: previews + theming (nixpkgs ImageMagick is built with SVG support)
+			memcached  # WordPress object-cache plugins (legacy option for Nextcloud)
+		]);

-	custom-php = pkgs.php83.buildEnv {
-		extensions = { enabled, all }: enabled ++ (with all; [ bz2 apcu redis imagick memcached ]);
 		extraConfig = ''
+			; ── Error handling (production) ─────────────────────────────────
+			display_errors = Off
+			display_startup_errors = Off
+			log_errors = On

-			display_errors = On
-			display_startup_errors = On
+			; ── Limits ──────────────────────────────────────────────────────
 			max_execution_time = 10000
 			max_input_time = 3000
-			memory_limit = 1G;
-			opcache.enable=1;
-			opcache.memory_consumption=512;
-			opcache_revalidate_freq = 240;
-			opcache.max_accelerated_files=20000;
+			memory_limit = 1G
 			post_max_size = 3G
 			upload_max_filesize = 3G
-			apc.enable_cli=1
-			opcache.interned_strings_buffer = 192
-			redis.session.locking_enabled=1
-			redis.session.lock_retries=-1
-			redis.session.lock_wait_time=10000

+			; ── OPcache (Nextcloud "Server tuning" recommendations) ─────────
+			opcache.enable = 1
+			opcache.memory_consumption = 512
+			opcache.interned_strings_buffer = 192
+			opcache.max_accelerated_files = 20000
+			opcache.revalidate_freq = 240
+			opcache.save_comments = 1
+
+			; ── APCu ────────────────────────────────────────────────────────
+			apc.enable_cli = 1
+
+			; ── phpredis session locking (only used with session.save_handler = redis)
+			redis.session.locking_enabled = 1
+			redis.session.lock_retries = -1
+			redis.session.lock_wait_time = 10000
 		'';
 	};
 in
@@ -55,3 +96,4 @@ in
 		];
 	};
 }
+
@@ -94,16 +94,23 @@ EOF
  # ── Synapse service ─────────────────────────────────────────
  services.matrix-synapse = {
    enable = true;
+    # cache-memory provides cache-size statistics for the autotuning below
+    # (in addition to the NixOS defaults).
+    extras = [ "systemd" "postgres" "url-preview" "cache-memory" ];
    extraConfigFiles = [
      "/run/matrix-synapse/runtime-config.yaml"
    ];
    settings = {
      database = {
        name = "psycopg2";
+        # Recycle pooled connections less often (fewer reconnects).
+        txn_limit = 10000;
        args = {
          host = "localhost";
          database = "matrix-synapse";
          user = "matrix-synapse";
+          cp_min = 5;
+          cp_max = 15;
        };
      };
      push.include_content = false;
@@ -120,6 +127,32 @@ EOF
      ];
      presence.enabled = true;
      enable_registration = false;
+      # ── Performance (32 GB Server + Desktop) ─────────────────
+      # Synapse trades RAM for fewer Postgres round-trips; most RAM goes
+      # to caches. Stock is global_factor 0.5 + 10K event cache, which
+      # leaves syncs hitting the database on every request.
+      # Deliberately unchanged: presence and URL previews stay enabled —
+      # disabling them is faster but changes user-visible behavior.
+      event_cache_size = "100K";
+      caches = {
+        global_factor = 4.0;
+        expire_caches = true;
+        cache_entry_ttl = "30m";
+        sync_response_cache_duration = "2m";
+        cache_autotuning = {
+          max_cache_memory_usage = "2G";
+          target_cache_memory_usage = "1G";
+          min_cache_ttl = "30s";
+        };
+        per_cache_factors = {
+          # Hot paths for /sync and room joins.
+          get_users_in_room = 3.0;
+          get_current_state_ids = 3.0;
+          get_unread_event_push_actions_by_room_for_user = 5.0;
+        };
+      };
+      # Fewer GC pauses at the cost of a little more memory.
+      gc_thresholds = [ 1500 20 10 ];
      listeners = [
        {
          port = 8008;
@@ -0,0 +1,110 @@
+"""Guards for the LAN-only Caddy sites.
+
+The Hub (http://sovransystemsos.local), Ride The Lightning (:3051) and Mempool
+(:60847) sites are for the home network. Caddy has to check where a request comes
+from because forwarding ports 80/443 on the router lets other clients reach it too.
+The domain sites for the operator's own public services must stay public.
+
+These read modules/core/caddy.nix like the nix-file checks in test_security.py:
+nothing is run and nothing touches the network.
+"""
+
+import ipaddress
+import os
+import re
+import unittest
+
+_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+
+# What Caddy's "private_ranges" shortcut expands to (see the remote_ip matcher docs).
+_PRIVATE_RANGES = ["192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8",
+                   "127.0.0.1/8", "fd00::/8", "::1"]
+
+_LAN_SITES = ("http://sovransystemsos.local", ":3051", ":60847")
+
+
+def _read(*parts):
+    with open(os.path.join(_ROOT, *parts), encoding="utf-8") as f:
+        return f.read()
+
+
+def _site(src, address):
+    m = re.search(r"^" + re.escape(address) + r" \{\n(.*?)^\}$", src, re.S | re.M)
+    return m.group(1) if m else None
+
+
+def _snippet(src):
+    m = re.search(r"^\(sovran_lan_only\) \{\n(.*?)^\}$", src, re.S | re.M)
+    return m.group(1) if m else None
+
+
+def _allowed_networks(snippet):
+    m = re.search(r"^\s*@outside not remote_ip (.+)$", snippet, re.M)
+    assert m, "the @outside matcher is missing"
+    nets = []
+    for token in m.group(1).split():
+        for cidr in (_PRIVATE_RANGES if token == "private_ranges" else [token]):
+            nets.append(ipaddress.ip_network(cidr, strict=False))
+    return nets
+
+
+def _is_allowed(nets, address):
+    ip = ipaddress.ip_address(address)
+    return any(ip.version == n.version and ip in n for n in nets)
+
+
+class LanOnlySites(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.src = _read("modules", "core", "caddy.nix")
+
+    def test_lan_sites_use_the_guard_before_they_proxy(self):
+        for address in _LAN_SITES:
+            with self.subTest(site=address):
+                body = _site(self.src, address)
+                self.assertIsNotNone(body, f"{address} site not found")
+                self.assertIn("import sovran_lan_only", body)
+                self.assertLess(body.index("import sovran_lan_only"),
+                                body.index("reverse_proxy"))
+
+    def test_only_the_lan_sites_use_the_guard(self):
+        self.assertEqual(self.src.count("import sovran_lan_only"), len(_LAN_SITES))
+        public = re.findall(r"^\$[A-Z]+ \{\n(.*?)^\}$", self.src, re.S | re.M)
+        self.assertGreaterEqual(len(public), 6, "domain sites not found")
+        for body in public:
+            self.assertNotIn("sovran_lan_only", body)
+        # the Matrix site that Element calling writes instead of the plain one
+        self.assertNotIn("sovran_lan_only", _read("modules", "element-calling.nix"))
+
+    def test_guard_closes_the_connection_for_everyone_else(self):
+        snippet = _snippet(self.src)
+        self.assertIsNotNone(snippet, "(sovran_lan_only) snippet not found")
+        self.assertRegex(snippet, r"(?m)^\s*abort @outside\s*$")
+        # defined before the first site that imports it
+        self.assertLess(self.src.index("(sovran_lan_only) {"),
+                        self.src.index("import sovran_lan_only"))
+
+    def test_guard_ranges(self):
+        nets = _allowed_networks(_snippet(self.src))
+        for address in ("127.0.0.1", "::1", "10.0.0.1", "172.16.0.1", "172.31.255.254",
+                        "192.168.1.10", "100.64.0.1", "100.127.255.254", "169.254.1.1",
+                        "fd12:3456::1", "fe80::1", "fc00::1"):
+            with self.subTest(allowed=address):
+                self.assertTrue(_is_allowed(nets, address))
+        for address in ("8.8.8.8", "1.1.1.1", "203.0.113.9", "9.255.255.255", "11.0.0.1",
+                        "172.15.255.255", "172.32.0.1", "192.169.0.1", "100.63.255.255",
+                        "100.128.0.1", "169.253.255.255"):
+            with self.subTest(refused=address):
+                self.assertFalse(_is_allowed(nets, address))
+
+    def test_ipv6_global_addresses_are_not_filtered(self):
+        # Computers on the home network often connect over their own global IPv6
+        # address, which cannot be told apart from the internet's by address alone.
+        # If this is ever tightened, LAN clients on IPv6 networks lose the Hub.
+        nets = _allowed_networks(_snippet(self.src))
+        self.assertTrue(_is_allowed(nets, "2001:db8::5"))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,249 @@
+"""Tests for the DDNS runner (sovran_systemsos_web.ddns_update).
+
+The runner asks Njal.la to use the address the request came from ("&auto"),
+reads back the address Njal.la recorded and saves it for LiveKit and the Hub.
+
+Tests must never:
+  - access the network (curl is replaced by a fake ``run``)
+  - write to system paths (the URL and IP files live in a temp dir)
+"""
+
+import contextlib
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+_REPO_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+_APP_PARENT = os.path.join(_REPO_ROOT, "app")
+if _APP_PARENT not in sys.path:
+    sys.path.insert(0, _APP_PARENT)
+
+from sovran_systemsos_web import ddns_update as d  # noqa: E402
+
+KEY = "SECRETKEY123"
+AUTO_URL = f"https://njal.la/update/?h=sub.example.com&k={KEY}&auto"
+LEGACY_URL = f"https://njal.la/update/?h=sub.example.com&k={KEY}&a=${{IP}}"
+PUBLIC_IP = "93.184.216.34"
+OTHER_IP = "8.8.4.4"
+
+
+def reply(ip=PUBLIC_IP, status=200):
+    return json.dumps({"status": status, "message": "record updated", "value": {"A": ip}})
+
+
+class FakeRun:
+    """Stands in for subprocess.run; records every command it is given."""
+
+    def __init__(self, stdout=None, returncode=0, raises=None):
+        self.stdout = reply() if stdout is None else stdout
+        self.returncode = returncode
+        self.raises = raises
+        self.calls = []
+
+    def __call__(self, cmd, **kwargs):
+        self.calls.append(cmd)
+        if self.raises:
+            raise self.raises
+        return subprocess.CompletedProcess(cmd, self.returncode, stdout=self.stdout, stderr="")
+
+
+class NormaliseUrlTests(unittest.TestCase):
+    def test_legacy_placeholder_becomes_auto(self):
+        self.assertEqual(d.normalise_url(LEGACY_URL), AUTO_URL)
+
+    def test_quiet_is_dropped_so_the_reply_can_be_read(self):
+        self.assertEqual(d.normalise_url(AUTO_URL + "&quiet"), AUTO_URL)
+
+    def test_plain_auto_is_unchanged(self):
+        self.assertEqual(d.normalise_url(AUTO_URL), AUTO_URL)
+
+    def test_explicit_address_is_unchanged(self):
+        url = "https://njal.la/update/?h=a.example.com&k=K&a=93.184.216.34"
+        self.assertEqual(d.normalise_url(url), url)
+
+
+class IsPublicIpv4Tests(unittest.TestCase):
+    def test_public_addresses(self):
+        for ip in ("93.184.216.34", "8.8.8.8", " 1.1.1.1\n"):
+            self.assertTrue(d.is_public_ipv4(ip), ip)
+
+    def test_everything_else_is_rejected(self):
+        for ip in ("10.0.0.1", "192.168.1.5", "172.16.0.9", "127.0.0.1", "169.254.1.1",
+                   "100.64.0.1", "0.0.0.0", "224.0.0.1", "::1", "2001:4860:4860::8888",
+                   "not-an-ip", "", None):
+            self.assertFalse(d.is_public_ipv4(ip), ip)
+
+
+class ParseReplyTests(unittest.TestCase):
+    def test_success_returns_the_recorded_address(self):
+        self.assertEqual(d.parse_reply(reply()), PUBLIC_IP)
+
+    def test_status_may_be_a_string(self):
+        self.assertEqual(d.parse_reply(reply(status="200")), PUBLIC_IP)
+
+    def test_error_status_is_rejected(self):
+        body = json.dumps({"status": 401, "message": "invalid host or key"})
+        self.assertIsNone(d.parse_reply(body))
+
+    def test_garbage_is_rejected(self):
+        for body in ("", "not json", "[]", "null", "{}", json.dumps({"status": 200})):
+            self.assertIsNone(d.parse_reply(body), body)
+
+    def test_non_public_or_non_ipv4_address_is_rejected(self):
+        for ip in ("10.1.2.3", "100.64.9.9", "127.0.0.1", "::1", "2001:4860:4860::8888", "x"):
+            self.assertIsNone(d.parse_reply(reply(ip)), ip)
+
+
+class IpFileTests(unittest.TestCase):
+    def test_write_then_read(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = os.path.join(tmp, "secrets", "external-ip")
+            d.write_ip_file(PUBLIC_IP, path)
+            self.assertEqual(d.read_ip_file(path), PUBLIC_IP)
+            self.assertEqual(open(path).read(), PUBLIC_IP)  # no trailing newline
+            self.assertEqual(os.stat(path).st_mode & 0o777, 0o644)
+
+    def test_replace_is_atomic_and_leaves_no_temp_files(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = os.path.join(tmp, "external-ip")
+            d.write_ip_file(PUBLIC_IP, path)
+            d.write_ip_file(OTHER_IP, path)
+            self.assertEqual(d.read_ip_file(path), OTHER_IP)
+            self.assertEqual(os.listdir(tmp), ["external-ip"])
+
+    def test_missing_file_reads_as_none(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            self.assertIsNone(d.read_ip_file(os.path.join(tmp, "nope")))
+
+
+class UpdateAllTests(unittest.TestCase):
+    def run_update(self, urls, fake):
+        out = io.StringIO()
+        with contextlib.redirect_stdout(out):
+            result = d.update_all(urls, run=fake)
+        return result, out.getvalue()
+
+    def test_curl_is_called_directly_with_ipv4_and_no_redirects(self):
+        fake = FakeRun()
+        result, _ = self.run_update([AUTO_URL], fake)
+        self.assertEqual(result, PUBLIC_IP)
+        self.assertEqual(len(fake.calls), 1)
+        cmd = fake.calls[0]
+        self.assertEqual(cmd[0], "curl")
+        for flag in ("--ipv4", "--no-location", "--fail", "--silent"):
+            self.assertIn(flag, cmd)
+        self.assertEqual(cmd[-1], AUTO_URL)
+
+    def test_legacy_entry_and_its_auto_twin_are_one_call(self):
+        fake = FakeRun()
+        self.run_update([LEGACY_URL, AUTO_URL], fake)
+        self.assertEqual(fake.calls[0][-1], AUTO_URL)
+        self.assertEqual(len(fake.calls), 1)
+
+    def test_url_for_another_host_is_never_called(self):
+        fake = FakeRun()
+        result, _ = self.run_update([f"https://evil.example/update/?h=x&k={KEY}&auto"], fake)
+        self.assertIsNone(result)
+        self.assertEqual(fake.calls, [])
+
+    def test_failed_curl_yields_nothing(self):
+        result, _ = self.run_update([AUTO_URL], FakeRun(returncode=22))
+        self.assertIsNone(result)
+
+    def test_reply_without_an_address_yields_nothing(self):
+        result, _ = self.run_update([AUTO_URL], FakeRun(stdout=json.dumps({"status": 200})))
+        self.assertIsNone(result)
+
+    def test_missing_curl_is_survived(self):
+        result, out = self.run_update([AUTO_URL], FakeRun(raises=FileNotFoundError("curl")))
+        self.assertIsNone(result)
+        self.assertIn("skipped", out)
+
+    def test_first_reported_address_wins(self):
+        calls = iter([reply(PUBLIC_IP), reply(OTHER_IP)])
+
+        def fake(cmd, **kwargs):
+            return subprocess.CompletedProcess(cmd, 0, stdout=next(calls), stderr="")
+
+        other = f"https://njal.la/update/?h=other.example.com&k={KEY}&auto"
+        out = io.StringIO()
+        with contextlib.redirect_stdout(out):
+            result = d.update_all([AUTO_URL, other], run=fake)
+        self.assertEqual(result, PUBLIC_IP)
+
+    def test_the_key_is_never_printed(self):
+        for fake in (FakeRun(), FakeRun(returncode=22), FakeRun(stdout="junk"),
+                     FakeRun(raises=FileNotFoundError("curl"))):
+            _, out = self.run_update([AUTO_URL, LEGACY_URL], fake)
+            self.assertNotIn(KEY, out)
+
+
+class MainTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.urls_file = os.path.join(self.tmp.name, "ddns_urls.json")
+        self.ip_file = os.path.join(self.tmp.name, "secrets", "external-ip")
+        for patch in (mock.patch.object(d, "URLS_FILE", self.urls_file),
+                      mock.patch.object(d, "IP_FILE", self.ip_file)):
+            patch.start()
+            self.addCleanup(patch.stop)
+
+    def store(self, urls):
+        with open(self.urls_file, "w") as f:
+            json.dump(urls, f)
+
+    def main(self, fake):
+        out = io.StringIO()
+        with mock.patch.object(d.subprocess, "run", fake), contextlib.redirect_stdout(out):
+            code = d.main()
+        self.assertEqual(code, 0)
+        return out.getvalue()
+
+    def test_first_update_records_the_address(self):
+        self.store([LEGACY_URL])
+        out = self.main(FakeRun())
+        self.assertEqual(d.read_ip_file(self.ip_file), PUBLIC_IP)
+        self.assertIn("now " + PUBLIC_IP, out)
+        self.assertNotIn(KEY, out)
+
+    def test_unchanged_address_does_not_touch_the_file(self):
+        # A path unit restarts LiveKit whenever the file is written, so an
+        # unchanged address must not rewrite it.
+        self.store([AUTO_URL])
+        self.main(FakeRun())
+        before = os.stat(self.ip_file)
+        out = self.main(FakeRun())
+        after = os.stat(self.ip_file)
+        self.assertEqual((before.st_ino, before.st_mtime_ns), (after.st_ino, after.st_mtime_ns))
+        self.assertIn("unchanged", out)
+
+    def test_changed_address_is_recorded(self):
+        self.store([AUTO_URL])
+        self.main(FakeRun(stdout=reply(PUBLIC_IP)))
+        out = self.main(FakeRun(stdout=reply(OTHER_IP)))
+        self.assertEqual(d.read_ip_file(self.ip_file), OTHER_IP)
+        self.assertIn(f"now {OTHER_IP} (was {PUBLIC_IP})", out)
+
+    def test_failed_update_keeps_the_last_known_address(self):
+        self.store([AUTO_URL])
+        self.main(FakeRun(stdout=reply(PUBLIC_IP)))
+        self.main(FakeRun(returncode=7))
+        self.assertEqual(d.read_ip_file(self.ip_file), PUBLIC_IP)
+
+    def test_nothing_configured_does_nothing(self):
+        fake = FakeRun()
+        self.main(fake)  # no URL file at all
+        self.store([])
+        self.main(fake)  # empty list
+        self.assertEqual(fake.calls, [])
+        self.assertFalse(os.path.exists(self.ip_file))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,68 @@
+"""Guards for the home-IP warnings.
+
+Server + Desktop publishes the home IP address (the domain points at it), so every
+place that offers Server + Desktop must say so, and the README section they point
+at must exist.
+
+These read the shipped source files like the nix-file checks in test_security.py:
+nothing is run and nothing touches the network.
+"""
+
+import os
+import re
+import unittest
+
+_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+_PHRASE = "home ip address"
+
+
+def _read(*parts):
+    with open(os.path.join(_ROOT, *parts), encoding="utf-8") as f:
+        return f.read()
+
+
+def _github_slug(heading):
+    slug = re.sub(r"[^\w\- ]", "", heading.strip().lower())
+    return slug.replace(" ", "-")
+
+
+class HomeIpWarnings(unittest.TestCase):
+
+    def test_installer_role_card(self):
+        src = _read("iso", "installer.py")
+        card = re.search(r'\("Server \+ Desktop",\s*"((?:[^"\\]|\\.)*)"', src, re.S)
+        self.assertIsNotNone(card, "Server + Desktop role card not found")
+        self.assertIn(_PHRASE, card.group(1).lower())
+
+    def test_hub_domain_setup_text(self):
+        # domain-prereqs.js is the single source for onboarding, feature setup
+        # and domain reconfiguration; the notice must follow every variant.
+        js = _read("app", "sovran_systemsos_web", "static", "js", "domain-prereqs.js")
+        body = js[js.index("function renderDomainNeedsHtml"):]
+        body = body[:body.index("\n}\n")]
+        self.assertIn(_PHRASE, body.lower())
+        self.assertGreater(body.lower().index(_PHRASE), body.rindex("} else {"),
+                           "the notice must come after the last variant, not inside one")
+
+    def test_hub_upgrade_dialog(self):
+        html = _read("app", "sovran_systemsos_web", "templates", "index.html")
+        dialog = html[html.index('id="upgrade-modal"'):html.index("Security Reset overlay")]
+        self.assertIn(_PHRASE, " ".join(dialog.lower().split()))
+
+    def test_readme_and_security_policy(self):
+        self.assertIn(_PHRASE, _read("README.md").lower())
+        self.assertIn(_PHRASE, " ".join(_read("SECURITY.md").lower().split()))
+
+    def test_links_to_the_readme_section_resolve(self):
+        readme = _read("README.md")
+        slugs = {_github_slug(m.group(2))
+                 for m in re.finditer(r"^(#{1,6})\s+(.+?)\s*$", readme, re.M)}
+        links = re.findall(r"\]\(#(server--desktop[^)]*)\)", readme)
+        links += re.findall(r"README\.md#(server--desktop[^)\s]*)", _read("SECURITY.md"))
+        self.assertTrue(links, "expected links to the home-IP section")
+        for anchor in links:
+            self.assertIn(anchor, slugs)
+
+
+if __name__ == "__main__":
+    unittest.main()
Author	SHA1	Message	Date
Arena.ai Agent	c33457fff2	caddy: serve the Hub, RTL and Mempool sites to local clients only The Hub (sovransystemsos.local), Ride The Lightning (:3051) and Mempool (:60847) sites are meant for the home network. With ports 80/443 forwarded for public services, Caddy also receives requests from other clients, so these sites now check the client address as well as the Host header. A new snippet, sovran_lan_only, closes the connection unless the client is on this computer or the local network: private_ranges, 100.64.0.0/10 (Tailscale), 169.254.0.0/16, fe80::/10 and fc00::/7. IPv6 global addresses (2000::/3) are not filtered: computers on the network often connect over their own global address, which cannot be told apart from one on the internet by the address alone. Only the three local sites import the snippet; the domain sites for public services are unchanged. Clients with a public IPv4 address on the local network are no longer served on these sites. The Hub is still available on port 8937. Checked with Caddy 2.11.4 and the Caddyfile the generator writes: public IPv4 clients get the connection closed on all three sites, local clients are served, and the public domain sites answer as before. Add tests/test_caddy_lan_only.py and a note in SECURITY.md.	2026-10-01 21:43:47 -05:00
Arena.ai Agent	34cfba4282	docs, hub, installer: say Server + Desktop makes the home IP public Server + Desktop publishes services under the operator's own domain, and the DNS record for that domain points at the home connection, so anyone can look up the home IP address. None of the places that offer Server + Desktop said so. - README: new section "Server + Desktop and your home IP address" (what becomes public, what does not, the alternatives, and what happens technically), plus a note on the role table and in the security overview. - SECURITY.md: a matching section, the consequence noted next to "Public web services exposed only when enabled by the operator", and the supported versions row no longer pins 1.0.x. - ISO installer: the Server + Desktop role card ends with the warning. - Hub: the domain setup text (onboarding, feature setup and domain reconfiguration share renderDomainNeedsHtml) and the upgrade dialog carry the same notice. - Add tests/test_exposure_guards.py. It fails if one of these places loses the notice or the README anchor stops resolving.	2026-10-01 21:43:47 -05:00
Arena.ai Agent	2d777450e1	ddns: take the public IP from Njal.la only and give it to LiveKit The Hub no longer asks a STUN server, a public DNS resolver or a "what is my IP" service for the home IP address. The DDNS update asks Njal.la to use the address the request comes from ("&auto"), reads back the address Njal.la says it recorded and saves it to /var/lib/secrets/external-ip. Njal.la is the only third party that learns the address; it has to, to publish it. - Add app/sovran_systemsos_web/ddns_update.py, installed as /etc/sovran/ddns-update.py and run by sovran-ddns-update.service. It runs curl --ipv4 without redirects, accepts only a public IPv4 address, and rewrites the file atomically and only when the address changes. Stored "&a=${IP}" URLs are converted when they are used and "&quiet" is dropped. - Rewrite modules/core/njalla.nix around that runner and delete modules/core/public-ip.nix. Setting a sovran_systemsOS.publicIP.* option now fails with a message that says where the address comes from. Activation removes the old scripts in /var/lib/sovran. The existing external-ip file keeps working. - server.py reads the saved address and starts sovran-ddns-update.service after a domain is saved, instead of looking the address up itself. - Element calling uses sovran_systemsOS.elementCalling.externalIP if set, otherwise the saved address, and fails with a clear message when neither exists or the address is not public. It no longer falls back to STUN. livekit-external-ip.path re-runs livekit-turn-setup and starts LiveKit when the address changes. - Add tests/test_ddns_update.py.	2026-10-01 21:43:47 -05:00
naturallaw777	726fec1990	updated nixpkgs and Sovran_Bitcoin update and the new Bisq 1.10.9	2026-10-01 13:36:12 -05:00
naturallaw777	70ccf1eba1	chore(release): prepare v1.1.7	2026-09-21 18:09:10 -05:00
naturallaw777	f6caa2ff32	updated nixpkgs	2026-09-21 18:07:21 -05:00
Sovran Contributor	8bc325b148	postgresql: drop per-database autovacuum ALTERs (rejected by Postgres) Follow-up to the previous two commits: the ALTER DATABASE ... SET autovacuum_* commands fail at boot with ERROR: parameter "autovacuum_vacuum_scale_factor" cannot be changed now and take matrix-synapse-db-tune.service (and nextcloud-db-init.service) down with them. Root cause: ALTER DATABASE/ROLE ... SET validates through set_config_option() with an interactive context, and guc.c rejects any PGC_SIGHUP parameter set that way. All autovacuum_* GUCs are SIGHUP-context, so per-database scoping is impossible for them — only USERSET-level parameters (e.g. work_mem, statement_timeout) can be set per-database. Nothing is lost: the same values are already set cluster-wide in configuration.nix, which covers both nextclouddb and matrix-synapse. Remove the ALTERs from nextcloud-db-init and delete the now-purposeless matrix-synapse-db-tune service.	2026-09-21 14:21:01 -05:00
Sovran Contributor	e31094c194	synapse: performance tuning for 32 GB Server+Desktop hosts Monolith Synapse spends most of its RAM on caches to avoid Postgres round-trips, but Sovran ships stock cache settings (global_factor 0.5, 10K event cache, no autotuning) and a default 5-connection DB pool. - caches.global_factor 4.0 + 100K event cache + autotuning capped at 2G (target 1G), with boosts for the /sync and room-join hot paths. - DB pool cp_min 5 / cp_max 15, txn_limit 10000 (fewer reconnects). - gc_thresholds raised to cut GC pauses on a 32 GB box. - cache-memory extra for cache-size statistics. - Per-database autovacuum (ALTER DATABASE, scoped to matrix-synapse) matching the nextclouddb tuning. Deliberately unchanged: presence and URL previews stay enabled (disabling them is faster but user-visible), and no workers — monolith is the right call under ~100 users. Workers would need Redis replication, the redis extra, and Caddy reverse-proxy rework; revisit if federation load ever justifies it.	2026-09-21 14:00:19 -05:00
Sovran Contributor	09d4cc9b83	nextcloud, postgresql: fix Nextcloud 35 DB warnings on 32 GB hosts Nextcloud 35's Database checks flag three Performance issues out of the box: buffer cache hit ratio ~96% (wants 99%+), 100k+ dead tuples, and million-plus sequential scans on oc_mail_tags / oc_guests_users. Root causes in Sovran: stock 128MB shared_buffers, stock 60s autovacuum naptime, APCu file locking, and db:add-missing-indices running exactly once at install time (never on upgrades or app installs). Size Postgres for the README's Server + Desktop recommendation (32 GB RAM, NVMe): 2GB shared_buffers, 12GB effective_cache_size, 512MB maintenance_work_mem, 32MB work_mem, 4GB max_wal_size, 30s autovacuum naptime with 4 workers. shared_buffers stays below the 25% rule because Postgres shares the box with bitcoind, Electrs, LND, MariaDB and PHP-FPM. Scope the aggressive autovacuum to nextclouddb via ALTER DATABASE so the shared matrix-synapse DB keeps the milder cluster defaults. Add a local Redis (127.0.0.1:6379, Nextcloud only) and move memcache.distributed/locking to Redis; migrate existing installs with a one-shot since nextcloud-init never re-runs. Add a weekly nextcloud-db-maintenance timer (VACUUM ANALYZE + db:add-missing-*) so upgrades and later app installs can't regress the checks again. Note: shared_buffers needs one 'systemctl restart postgresql', which briefly takes down both Nextcloud and Matrix. Everything else is reload-only or scoped to nextclouddb.	2026-09-21 13:59:52 -05:00
naturallaw777	3341659a0c	updated to php85 and fixes	2026-09-19 16:24:57 -05:00
Sovran Systems	32e1119e33	Updated to proper syntax to prevent build errors.	2026-09-17 16:28:37 -05:00
Sovran Systems	0f7ef8422d	Clean up flake.nix by removing comments and LiveKit override Removed comments and overridden attributes for LiveKit version in flake.nix.	2026-09-17 16:19:37 -05:00
naturallaw777	dd6042928a	updated flake lock which contains Bisq 1.10.8 and Bisq2 2.1.13	2026-09-17 15:37:28 -05:00
naturallaw777	74405b2ffc	chore(release): prepare v1.1.6	2026-09-15 15:17:10 -05:00
naturallaw777	258da6a337	updated nix packages includes the new mempool version	2026-09-15 14:15:20 -05:00
Sovran Systems	73ab3f40c1	Rename 'The Sovran Hub' to 'The Hub' in README	2026-09-09 11:19:50 -05:00
Sovran Systems	0768712bf7	Rename 'Sovran Hub' to 'The Hub' in README Updated references from 'Sovran Hub' to 'The Hub' for consistency.	2026-09-09 11:19:03 -05:00
naturallaw777	2ac30dc10a	docs: update Sovran Hub screenshot to the v1.1.5 redesign Replace the pre-redesign Hub capture with the new welcome dashboard introduced in v1.1.5 — the default view showing system status, Bitcoin sync, and the update card at a glance. The capture is rendered from the real Hub frontend (Server + Desktop role, demo credentials/domains) at 1920x1080, and doubles as the hero shot of the marketing kit. Also drops the asset from 391 KB to 59 KB with no visible loss.	2026-09-09 11:04:57 -05:00
@@ -1 +1 @@
 .1.5
 .1.7