[Mimic890]

Stage 6: Grafana dashboard, Caddyfile.example and the full README in both languages.

Changes

• Caddyfile.example:
  • Caddy v2.11.7 with caddy-ratelimit v0.1.0 (1200 requests/min per client IP; /static/* and /assets/* are not counted) and caddy-crowdsec-bouncer v0.14.1.
  • HSTS, Server header removed, zstd/gzip.
  • /metrics and /reindex (and their subpaths) return 404.
  • /assets/* served from vault/assets/ with the extension allowlist, nosniff and the sandbox CSP.
  • 16 KB body limit on /api/*.
• grafana/hyperhack.json: dashboard with a data source variable and a post variable. Rows:
  • Overview
  • Posts (views per day, per-post table, read depth, votes)
  • Readers (source, device, language, theme, outbound clicks)
  • Search
  • HTTP
  • Sync
• README.md and README.ru.md, covering:
  • quick start and Garage keys;
  • every env variable;
  • every frontmatter field and its rules;
  • Remotely Save and Obsidian settings, and /reindex;
  • Caddy (the same block as Caddyfile.example) and TRUSTED_PROXIES;
  • VictoriaMetrics scrape config, Grafana import and the metrics list;
  • logs, backups and secret rotation;
  • upgrades and development.
• Both SPEC files: dashboard path, perimeter rate limit, Decision log entry.
• readme_test.go: fails if the Caddy block in README.md or README.ru.md differs from Caddyfile.example.

Tested

The test stack was the app image built from main, a custom Caddy build with both plugins, VictoriaMetrics v1.155.0 and Grafana 13.2.5.

• caddy validate and caddy fmt pass on Caddyfile.example.
• Through Caddy:
  • These all return 404: /metrics, /METRICS, /%6detrics, /metrics/x, /api/../metrics, and POST /reindex / /ReIndex.
  • /assets/x.html and /assets/ return 404. .hyperhack.json is not reachable.
  • Pages and assets carry the expected headers.
  • A 20 KB /api/beacon body returns 413.
  • Pages get 429 after 1200 requests a minute. Static files and assets keep returning 200 while the limit is hit (1500 requests each).
• Every dashboard query runs on VictoriaMetrics, using real beacon and search traffic. Screenshots of the dashboard were checked in light and dark themes.
• In a test container, the peer address seen for host → 127.0.0.1 published-port traffic is the Docker network gateway. That is what the README's TRUSTED_PROXIES instructions are based on.
• readme_test.go passes and fails on a one-character change in the Russian README block.
• gofmt, vet, staticcheck, govulncheck, go test -race.

Not tested

• CrowdSec against a live LAPI (CrowdSec is stripped from the test Caddyfile; the full file only passes caddy validate).
• TLS / HSTS on a real domain.
• Grafana with the VictoriaMetrics plugin data source; the dashboard was tested with a Prometheus-type data source only.