Mirror was stale (missing ~28 services incl. LubeLogger). Sync live->mirror and
redact every inline widget secret (19: plex/overseerr/tautulli/arr/sab keys +
proxmox/pbs/beszel/crowdsec passwords) to {{HOMEPAGE_VAR_*}} refs. Values now
live only in observability/.env (root:600, not a git repo), injected via env_file.
Verified: 21 referenced vars == 21 defined in container env (no referenced-but-
undefined); homepage healthy, widgets authenticate. Full-file + diff scan: clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
services.yaml now references key: "{{HOMEPAGE_VAR_HASS_TOKEN}}" instead of
the inline long-lived HA JWT (which was exposed in this public-fronted repo
and has been rotated + revoked). Secret now lives only in observability/.env
(untracked, mode 600). Add .gitignore for .env/secrets so this can't recur.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tommy