diff --git a/engine/lint-report.md b/engine/lint-report.md index 505640e..8aaf78a 100644 --- a/engine/lint-report.md +++ b/engine/lint-report.md @@ -1,6 +1,6 @@ # Vault Lint Report -Generated: 2026-08-23T18:00:04Z | Docs scanned: 116 | Elapsed: 0.0s +Generated: 2026-08-24T05:59:56Z | Docs scanned: 116 | Elapsed: 0.0s ## Summary diff --git a/vault/.obsidian/workspace.json b/vault/.obsidian/workspace.json index 842bc56..1412714 100644 --- a/vault/.obsidian/workspace.json +++ b/vault/.obsidian/workspace.json @@ -199,18 +199,19 @@ }, "active": "17bd4a6166f789d0", "lastOpenFiles": [ + "projects/meshtastic-headscale-runbook.md.tmp.3790074.f71d216eecca", + "projects/meshtastic-headscale-runbook.md.tmp.3790074.d94af273bec3", + "runbooks/expose-service-contabo.md.tmp.3790074.70782eb4562c", + "runbooks/expose-service-contabo.md.tmp.3790074.fe105eeb05b6", + "runbooks/expose-service-edge2.md.tmp.3790074.484208d24d9d", + "runbooks/expose-service-edge2.md.tmp.3790074.b2d7cda931c0", + "runbooks/expose-service-home.md.tmp.3790074.a7aea2f94658", + "runbooks/expose-service-home.md.tmp.3790074.b26454819896", + "docs/software/dns.md.tmp.3790074.fcdcf768c300", + "docs/software/dns.md.tmp.3790074.404f85bc78a4", "projects/meshwars.md", "projects/fleet-storage-memory-upgrade.md.tmp.2730138.81f9975eb3a6", - "runbooks/navi-lift-to-media.md.tmp.2730138.bee0e1488a4b", - "runbooks/navi-lift-to-media.md.tmp.2730138.cb383db7c987", - "runbooks/navi-lift-to-media.md.tmp.2730138.5755c5b630d8", - "runbooks/navi-lift-to-media.md.tmp.2730138.74d5fc239a82", - "projects/navi-recon-separation.md.tmp.2730138.1a9ee67ba5ca", "runbooks/navi-lift-to-media.md", - "runbooks/navi-lift-to-media.md.tmp.2730138.56b7ce0eca2e", - "docs/hardware/environment.md.tmp.2730138.237b7072261a", - "docs/hardware/environment.md.tmp.2730138.58738aa3e22c", - "docs/hardware/environment.md.tmp.2730138.e8527bb48e1d", "runbooks/edge2-boot-recovery.md", "runbooks/corescope-ingest-stall-oom.md", "projects/navi-recon-separation.md", @@ -234,7 +235,6 @@ "runbooks/central-deploy-cutover.md", "runbooks/fleet-magicdns-resolved-migration.md", "projects/fleet-platform-baseline.md", - "runbooks/toc-cortex-pve9.2-update.md", "Untitled.canvas", "assets/echo6yellow_logo_422x422_square.png", "assets/echo6yellow_logo_422x81.png", diff --git a/vault/docs/services/services.md b/vault/docs/services/services.md index 027a457..a8be3f3 100644 --- a/vault/docs/services/services.md +++ b/vault/docs/services/services.md @@ -38,6 +38,7 @@ updated: 2026-08-14 | Headscale | edge2 (CT 107) | 100.64.0.38:8084 | https://vpn.echo6.co | Tailscale coordination (OIDC enabled) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** | | Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** | | Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place [[2026-06-19]]** | +| MeshWars Preview | utility (CT 113) | 192.168.1.113 / 100.64.0.39:8090 | https://mwpreview.k7zvx.com | Public preview of the unreleased `feat/places` MeshWars branch, running a periodically-refreshed read-only copy of production (CT 119) data; /admin and /api/admin/* return 404 on the public host, admin reachable only over the tailnet | | Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager 1.37.1 (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) | | Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet | | Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) | @@ -170,6 +171,14 @@ updated: 2026-08-14 - Response: 175 char chunks × 3 messages max - Compose path: `/home/zvx/meshai/docker-compose.yml` +### utility - CT 113 (192.168.1.113 / Tailscale: 100.64.0.39) +- MeshWars Preview — public preview instance of the `feat/places` branch (Docker, compose path `/home/zvx/meshwars/docker-compose.yml`) +- Fronted by utility [[caddy]] at https://mwpreview.k7zvx.com (Tailscale IP, /admin + /api/admin/* blocked with 404 on the public host) +- /admin still reachable directly over the tailnet at 100.64.0.39:8090/admin +- Database is a SQLite online-backup clone of CT 119's `game.db`, taken read-only; the `place` seed table is not present in production's schema yet and is auto-reloaded by the app on each restart after a clone +- ADMIN_TOKEN is unique to this container, generated fresh — never copied from production +- Join and check-in registration disabled by default + ### utility - CT 118 (192.168.1.118) - Signal/Matrix room archive bot (archivist.service via systemd) - 1 core, 1GB RAM, 8GB disk diff --git a/vault/docs/software/caddy.md b/vault/docs/software/caddy.md index 00a6fd3..0a5043d 100644 --- a/vault/docs/software/caddy.md +++ b/vault/docs/software/caddy.md @@ -79,6 +79,7 @@ journalctl -u caddy -f | lidarr.echo6.co | 100.64.0.18:8686 | Tailscale | lidarr music automation (Authentik forward auth) | | navidrome.echo6.co | 100.64.0.18:4533 | Tailscale | navidrome music server (Authentik forward auth, /rest/* exempt for Subsonic API) | | vpn.idahomesh.com | 192.168.1.106:8080 | Local IP | IdahoMesh Headscale VPN coordination | +| mwpreview.k7zvx.com | 100.64.0.39:8090 | Tailscale | MeshWars public preview (CT 113, feat/places branch; /admin + /api/admin/* blocked -- 404 -- on this public host, reachable only over tailnet) | ### Commands diff --git a/vault/docs/software/dns.md b/vault/docs/software/dns.md index c25395d..e54fda8 100644 --- a/vault/docs/software/dns.md +++ b/vault/docs/software/dns.md @@ -10,13 +10,32 @@ related: - [[expose-service-contabo]] - [[usenet]] - [[expose-service-edge2]] -updated: 2026-07-13 +updated: 2026-08-24 --- # GoDaddy DNS Management ## Script Location -`~/bin/godaddy-dns.py` +`~/bin/godaddy-dns.py` on **cortex** (100.64.0.14). Restored 2026-08-24 — the +original copy was lost in a host rebuild and these docs pointed at a script +that no longer existed anywhere on the fleet for some time; that cost real +time mid-deploy. Python 3 standard library only, no pip installs. + +## THE RECORD-SET TRAP + +GoDaddy's API has two kinds of write endpoints for A records: + +- `PUT /v1/domains//records/A/` — replaces only ``. Safe. +- `PUT /v1/domains//records/A` and `PUT /v1/domains//records` + — **replace every record of that type on the whole domain.** + +Both `k7zvx.com` and `echo6.co` front live production services (mail, auth, +forge, vpn, vault, matrix, element, and more). Calling one of the record-SET +endpoints to "add" a record would wipe every other A record on the zone. +`godaddy-dns.py` only ever uses the single-record endpoint to write, and does +not implement the record-set endpoints at all. `add-a` always reads the full +A-record list before and after and prints a diff, so you can see nothing +else changed. ## API Credentials @@ -36,29 +55,34 @@ Stored in `/home/zvx/projects/.ref/credentials` as: arclightvanguard.com, echo6.co, echo6.org, happylittlellc.com, idahomesh.com, k7zvx.com, lpmesh.com, maliceinwonderland.org, matthewwayne.com, smugglersden.co, underdogs.cc +## Subcommands + +`godaddy-dns.py` currently supports A records only: + +- `list ` — list all A records for a domain +- `get-a ` — show the A record(s) for one name +- `add-a [--ttl SECONDS] [--dry-run]` — add/update a + single A record via the safe single-record endpoint; prints a before/after + diff of the whole domain's A records + +There is no CNAME/MX/delete/multi-domain support — add-a is add-or-update +(PUT to the single-record endpoint), and there is no destructive delete or +record-set command by design (see the trap above). + ## Usage Examples ```bash -# List all domains -godaddy-dns.py list-domains - -# List records for a domain +# List all A records for a domain godaddy-dns.py list echo6.co -# Add A record +# Look up one record +godaddy-dns.py get-a echo6.co www + +# Add/update an A record godaddy-dns.py add-a echo6.co www 199.6.36.163 -# Add CNAME record -godaddy-dns.py add-cname echo6.co blog www.echo6.co - -# Add MX record with priority -godaddy-dns.py add-mx echo6.co mail.echo6.co --priority=10 - -# Delete record -godaddy-dns.py delete echo6.co A www - -# Configure MX for all domains -godaddy-dns.py setup-mail +# Preview a change without writing anything +godaddy-dns.py add-a echo6.co www 199.6.36.163 --dry-run ``` ## Common Patterns diff --git a/vault/projects/meshtastic-headscale-runbook.md b/vault/projects/meshtastic-headscale-runbook.md index d9f1e64..591fb25 100644 --- a/vault/projects/meshtastic-headscale-runbook.md +++ b/vault/projects/meshtastic-headscale-runbook.md @@ -10,7 +10,7 @@ related: - [[meshtastic-sidecar-node]] - [[headscale-onboard-node]] - [[services]] -updated: 2026-07-13 +updated: 2026-08-24 --- # IdahoMesh Tailnet Runbook @@ -471,8 +471,8 @@ systemctl reload caddy' ### 3.4 Add GoDaddy DNS Record ```bash -# On cortex/TOC -source /home/zvx/projects/.ref/credentials +# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads +# credentials from .ref/credentials itself godaddy-dns.py add-a idahomesh.com vpn 199.6.36.163 ``` diff --git a/vault/runbooks/expose-service-contabo.md b/vault/runbooks/expose-service-contabo.md index 4e2f1ee..bfce1a5 100755 --- a/vault/runbooks/expose-service-contabo.md +++ b/vault/runbooks/expose-service-contabo.md @@ -10,7 +10,7 @@ related: - [[lxc-service-migration]] - [[caddy]] - [[services]] -updated: 2026-07-13 +updated: 2026-08-24 --- # Expose Service on Contabo @@ -34,12 +34,14 @@ docker compose up -d ### 2. Add DNS record ```bash -# On TOC -source /home/zvx/projects/.ref/credentials +# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads +# credentials from .ref/credentials itself godaddy-dns.py add-a echo6.co 5.189.158.149 dig +short .echo6.co @8.8.8.8 # Verify ``` +See [[dns]] for the record-set trap and full subcommand list. + ### 3. Add Caddy site block ```bash diff --git a/vault/runbooks/expose-service-edge2.md b/vault/runbooks/expose-service-edge2.md index 3d00695..ee91d1c 100644 --- a/vault/runbooks/expose-service-edge2.md +++ b/vault/runbooks/expose-service-edge2.md @@ -10,7 +10,7 @@ related: - [[expose-service-home]] - [[edge2-access-reference]] - [[caddy]] -updated: 2026-07-13 +updated: 2026-08-24 --- # Expose Service on edge2 (Contabo Cloud VPS) @@ -103,11 +103,13 @@ sudo systemctl reload caddy **GoDaddy domains:** ```bash -# On cortex/toc -source /home/zvx/projects/.ref/credentials +# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads +# credentials from .ref/credentials itself godaddy-dns.py add-a 184.174.35.153 ``` +See [[dns]] for the record-set trap and full subcommand list. + **Cloudflare domains:** Manual via Cloudflare dashboard (no API token): 1. A record → 184.174.35.153 (proxied / orange cloud) diff --git a/vault/runbooks/expose-service-home.md b/vault/runbooks/expose-service-home.md index b3a0e6a..f9837cf 100755 --- a/vault/runbooks/expose-service-home.md +++ b/vault/runbooks/expose-service-home.md @@ -10,7 +10,7 @@ related: - [[proxmox-onboard-node]] - [[headscale-onboard-node]] - [[ct-runbook]] -updated: 2026-07-13 +updated: 2026-08-24 --- # Expose Service on Home Network @@ -86,11 +86,14 @@ systemctl reload caddy" ### 5. Add DNS record ```bash -# On TOC -source /home/zvx/projects/.ref/credentials +# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there godaddy-dns.py add-a echo6.co 199.6.36.163 ``` +`godaddy-dns.py` reads credentials from `.ref/credentials` itself — no need +to `source` it. See [[dns]] for the record-set trap and full subcommand +list (`list`, `get-a`, `add-a --dry-run`). + ### 6. Update service CORS (if applicable) Add `https://.echo6.co` to the service's allowed origins.