docs(self-hosting): correct Grafana exposure claim, document Caddy/Tailscale TLS profiles

[JSONbored]

Summary

• Fixes a confirmed factual inaccuracy: docs.self-hosting-security.tsx claimed Grafana's port was private by default alongside Prometheus/Qdrant/Ollama, but docker-compose.yml's grafana service publishes ports: ["3000:3000"] (every interface), unlike Qdrant's confirmed 127.0.0.1:6333:6333 binding. Corrected the claim and added the mitigation (bind it yourself, or front it with Caddy/Tailscale).
• Adds a full "TLS termination" walkthrough to the security page for the caddy and tailscale compose profiles, which previously had exactly one line of documentation each (a table entry on the quickstart page): the shipped caddy/Caddyfile contents, DNS prerequisites for Let's Encrypt, the requirement to remove the gittensory service's own ports: mapping when fronting it with either profile (per the compose file's own comments at lines 72 and 349), bringing your own certs, running behind an existing reverse proxy/load balancer, and Tailscale's TS_AUTHKEY/network_mode: host/tailnet-:8787 reachability as the no-public-port alternative.
• Names and explains docker-proxy, the read-only Docker-socket proxy inside the observability profile that isolates Promtail's container-log service discovery from the raw Docker socket — previously never named on any docs page.
• Cross-links the new TLS termination section from docs.self-hosting-github-app.tsx's PUBLIC_API_ORIGIN setup, its pull/push relay-mode explanation, and its webhook-check curl example (all of which assumed a https://reviews.example.com origin already exists), and from the quickstart profile table.

Advances #1819.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes — docs-only, three files in apps/gittensory-ui/src/routes/.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• No specific tracked issue to close — this advances the self-host production-readiness roadmap (roadmap(selfhost): production hardening and first release readiness #1819) as documentation-depth work; see Summary for rationale.

Validation

• git diff --check
• npm run actionlint — not applicable, no workflow changes
• npm run typecheck (ran npm run ui:typecheck; no backend/src/** changes)
• npm run test:coverage — not applicable, docs-only change with no src/** lines touched (no Codecov obligation)
• npm run test:workers — not applicable, no worker code changed
• npm run build:mcp — not applicable, no MCP changes
• npm run test:mcp-pack — not applicable, no MCP changes
• npm run ui:openapi:check — not applicable, no API/schema changes
• npm run ui:lint (plus npm --workspace @jsonbored/gittensory-ui run format to fix prettier prose wrapping)
• npm run ui:typecheck
• npm run ui:build
• npm run docs:drift-check
• npm audit --audit-level=moderate — not applicable, no dependency changes
• New or changed behavior has unit/integration tests — not applicable, prose-only docs content

If any required check was skipped, explain why:

• This is a documentation-only change confined to apps/gittensory-ui/src/routes/*.tsx prose/JSX content. No src/**, worker, MCP, API, or dependency files changed, so the backend/coverage/audit/openapi/actionlint checks don't apply. Ran the full applicable subset (lint, typecheck, build, docs-drift-check) plus git diff --check, all green.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — not applicable, no such changes.
• API/OpenAPI/MCP behavior is updated and tested where needed — not applicable.
• UI changes use live API data or real empty/error/loading states — not applicable, static docs prose only.
• Visible UI changes include a UI Evidence section — this is docs prose/code-sample content on existing pages using existing components (Callout, CodeBlock, FeatureRow, Link), not a new visual surface; verified locally via npm run ui:build (clean SSR+client build) and a rendered dev-server check confirming the new "TLS termination" section and its subheadings appear correctly in the page's auto-generated on-this-page navigation.
• Public docs/changelogs are updated where needed; changelog itself not touched (not a release-prep PR).

Notes

• Verified the Grafana port claim directly against docker-compose.yml:419-420 (ports: ["3000:3000"]) vs. Qdrant's docker-compose.yml:277 (127.0.0.1:6333:6333).
• The Caddyfile walkthrough quotes the actual shipped caddy/Caddyfile verbatim rather than inventing an example.
• The docker-proxy rationale is drawn from the compose file's own comment at docker-compose.yml:517-526, not paraphrased from an external source.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	0170668	Commit Preview URL Branch Preview URL	Jul 05 2026, 01:53 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 01:53:26 UTC}

3 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Maintainer test expectations unmet — Add or update tests, or attach passing validation output that satisfies the maintainer's test expectations.

Review summary
The diff is docs-only and corrects the Grafana exposure claim while adding useful Caddy/Tailscale TLS guidance and cross-links from the GitHub App and quickstart pages. I do not see a reachable product or build break in the changed files; the main issues are wording precision where the new guidance could confuse operators about what is shipped versus external and where the referenced callout lives.

Nits — 6 non-blocking

• nit: apps/gittensory-ui/src/routes/docs.self-hosting-security.tsx:129 says "three shipped ways" but one of the three options is "Bring your own reverse proxy", which is explicitly not shipped; change this to "three supported ways" or split shipped profiles from external proxying.
• nit: apps/gittensory-ui/src/routes/docs.self-hosting-quickstart.tsx:213 says "see the callout below", but the detailed Tailscale callout is on the Security page, not below this paragraph; use "see the Security page callout" so the pointer is accurate.
• nit: apps/gittensory-ui/src/routes/docs.self-hosting-security.tsx:198 calls Caddy's localhost certificate "self-signed", but the paragraph immediately above describes Caddy's internal CA; say "internal-CA certificate" to avoid teaching the wrong TLS model.
• apps/gittensory-ui/src/routes/docs.self-hosting-security.tsx:129: change `These are the three shipped ways` to `These are the three supported ways`, or make the sentence `These are the two shipped profiles plus the supported bring-your-own-proxy path`.
• apps/gittensory-ui/src/routes/docs.self-hosting-quickstart.tsx:213: replace `see the callout below` with `see the Security page callout` so the cross-link matches the document structure.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Concerns raised — review before merging

• Maintainer test expectations unmet — Add or update tests, or attach passing validation output that satisfies the maintainer's test expectations.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 56 registered-repo PR(s), 46 merged, 423 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 56 PR(s), 423 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 56 PR(s), 423 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review