74 lines
4.3 KiB
Markdown
74 lines
4.3 KiB
Markdown
|
---
|
||
|
|
title: CLAUDE baseline (global rules)
|
||
|
|
type: reference
|
||
|
|
tags: [proxmox]
|
||
|
|
status: auto-generated
|
||
|
|
updated: 2026-06-19
|
||
|
|
---
|
||
|
|
|
||
|
|
> [!info] Auto-generated mirror of `~/.claude/CLAUDE.md` on cortex. Edit the source, not this file — it refreshes automatically.
|
||
|
|
|
||
|
|
# Echo6 Infrastructure — Claude Guidelines
|
||
|
|
|
||
|
|
## Locale
|
||
|
|
Timezone: America/Boise (Mountain Time)
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Working model — how we operate
|
||
|
|
|
||
|
|
**Matt guides → Opus orchestrates → Sonnet executes.**
|
||
|
|
|
||
|
|
- **Matt guides.** Sets the goal and makes the decisions.
|
||
|
|
- **Opus orchestrates — and *only* orchestrates.** Plans the work, breaks it into tight surgical tasks, dispatches **Sonnet** subagents to do them, reviews their output, and reports back. Opus does **not** do hands-on work itself — no editing files, running commands, or deploying directly. It plans, dispatches, verifies.
|
||
|
|
- **Sonnet executes — and *only* the prompt.** Runs one tightly-scoped task exactly as written. No scope creep, no initiative beyond the prompt. If the task is ambiguous or needs a decision → stop and report back to Opus; never guess.
|
||
|
|
|
||
|
|
Flow: **Matt → Opus plans → dispatches Sonnet (tight prompt) → Sonnet executes → Opus reviews → reports to Matt.**
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Critical policies — always apply
|
||
|
|
|
||
|
|
- **Gemini:** `gemini-2.5-flash-lite` only, every call. No exceptions.
|
||
|
|
- **Host protection:** never `shutdown`/`reboot`/`poweroff` any host; never include cortex (primary Claude Code host) or TOC in availability-affecting bulk operations; never install packages on any host (pip/npm/apt) without explicit permission.
|
||
|
|
- **No changes without approval:** never deploy, change service ports, or change network/firewall config without explicit approval. If a target is unreachable or blocked → **STOP and report**; never redirect to an alternate host.
|
||
|
|
- **Resilience:** every deployment must survive a reboot.
|
||
|
|
- **Credentials:** source from `.ref/credentials`; never commit secrets to a git-tracked file — *except* the private `echo6-docs` Forge repo (the one documented exception).
|
||
|
|
- **Git:** GitHub `origin` is the source of truth and push target — *except* `echo6-docs`, which lives on Forge directly. Branch off the default branch before committing. Commit/push only when asked.
|
||
|
|
- **When unsure → ASK.** Never assume, never improvise.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Infra cheat-sheet
|
||
|
|
|
||
|
|
| Host | Local IP | Tailscale | Role |
|
||
|
|
|------|----------|-----------|------|
|
||
|
|
| data | 192.168.1.240 | 100.64.0.6 | databases |
|
||
|
|
| utility | 192.168.1.241 | 100.64.0.5 | utility / monitoring |
|
||
|
|
| cloud | 192.168.1.242 | 100.64.0.4 | cloud / personal |
|
||
|
|
| media | 192.168.1.243 | 100.64.0.3 | media / *arr |
|
||
|
|
| toc | 192.168.1.244 | 100.64.0.13 | GPU host (passthrough → cortex) |
|
||
|
|
| **cortex** (VM 150) | 192.168.1.150 | 100.64.0.14 | GPU compute, **Claude Code**, AI |
|
||
|
|
| recon-vm (VM 1130) | 192.168.1.130 | 100.64.0.24 | recon pipeline |
|
||
|
|
| **edge1** (Contabo, rebuilt) | 5.189.158.149 | 100.64.0.40 | Proxmox edge node (PVE 8, LXC-only) — **Mail only** (Mailcow in CT 101 → 10.10.10.2) |
|
||
|
|
| **edge2** (Contabo) | 184.174.35.153 | 100.64.0.26 | Proxmox edge node (PVE 8, LXC-only) — **front door** for Auth, Forge, Notes, Matrix, Element, VPN, Vault; also hosts **PDM** (CT 100 → 100.64.0.28:8443) |
|
||
|
|
| pi-nas | 192.168.1.245 | 100.64.0.21 | NAS |
|
||
|
|
|
||
|
|
- **SSH:** `ssh zvx@<ip>` (key auth) for most; `root@<ip>` for Proxmox hosts + edge1/edge2. Password-auth exceptions (aida-nebra, mt-isr, toc, matt-desktop) → see `environment.md`.
|
||
|
|
- **dns targets:** mail/autodiscover/autoconfig → **edge1** `5.189.158.149`; auth, forge, notes, vpn, vault, matrix, element → **edge2** `184.174.35.153`; home services (echo6.co, ai, jellyfin, immich, nextcloud, recon, stream) → `199.6.36.163` (via utility caddy).
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Where the detail lives — load when needed
|
||
|
|
|
||
|
|
- **Docs vault** → `.ref/vault/` (Obsidian docs library; category-tagged, maintained by `.ref/engine/` — see `.ref/CLAUDE.md`)
|
||
|
|
- **Procedures / runbooks** → `.ref/vault/runbooks/`
|
||
|
|
- **Per-project context** → `.ref/vault/projects/<name>.md`
|
||
|
|
- **System conventions** (path-scoped) → `~/.claude/rules/`
|
||
|
|
- **Credentials** → `.ref/credentials`
|
||
|
|
- **Editing vault docs:** category tags + `[[links]]` to *existing* docs only; no entity/concept pages, no INDEX. Engine handles it. Details → `.ref/CLAUDE.md`.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Default behavior
|
||
|
|
When unsure → **ASK**. Default to internal access. Document everything. Never assume; never improvise.
|