# Vault nginx serving — failed attempt (2026-08-15)

## What we tried
Serve the Syncthing-mirrored Obsidian vault at `https://vault.robblake.cloud/` via nginx so the user could click URLs instead of downloading HTML files.

## Three independent blockers (all produced silent 404)

1. `/root` is mode `700` — nginx runs as `www-data` and cannot traverse `/root/.hermes/` no matter what permissions are set on inner directories.
2. Bind-mounting `/root/.hermes/vault` to `/var/www/vault` still failed — nginx workers did not see the mount until a full nginx restart (not reload), and after restart the bind mount itself had issues.
3. AppArmor has no profile for nginx and no rules allowing `/var/www/vault/` reads.

## Decision
Stop trying to serve vault files via nginx. Use `MEDIA:` prefix delivery instead — it opens HTML files inline in the chat browser reliably.

## If a subdomain URL is ever needed
Move the vault to a non-`/root` path (e.g. `/srv/vault/`) and sync it there via Syncthing or a cron rsync. Do not fight permissions on the current path.