Initial commit

.env.example

@@ -0,0 +1,17 @@
+# Absolute path to the vault to serve. With Syncthing, this is the synced
+# folder itself. Point it at a COPY until you trust write-back — this service
+# rewrites the files it finds.
+VAULT_PATH=/home/you/notes
+
+# Write-back runs as this uid/gid. It MUST match the owner of VAULT_PATH,
+# otherwise writes fail or Syncthing fights over file permissions.
+#   VAULT_UID=$(id -u)  VAULT_GID=$(id -g)
+VAULT_UID=1000
+VAULT_GID=1000
+
+# Where to publish the CalDAV port for the reverse-proxy machine to reach.
+# TLS terminates at that proxy, so this listener is plain HTTP — set
+# BIND_ADDRESS to this host's LAN address rather than leaving it on all
+# interfaces, and firewall the port to the proxy's IP.
+BIND_ADDRESS=0.0.0.0
+BIND_PORT=5233