matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auto: docs sync 2026-08-24T06:00:04+00:00

Browse source 
Files changed: engine/lint-report.md vault/.obsidian/workspace.json vault/docs/services/services.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/projects/meshtastic-headscale-runbook.md vault/runbooks/expose-service-contabo.md vault/runbooks/expose-service-edge2.md vault/runbooks/expose-service-home.md
This commit is contained in:
echo6-autocommit 2026-08-24 06:00:04 +00:00
commit 1441234ef4
9 changed files with 82 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

20
vault/.obsidian/workspace.json vendored
View file

@ -199,18 +199,19 @@
},
"active": "17bd4a6166f789d0",
"lastOpenFiles": [
"projects/meshtastic-headscale-runbook.md.tmp.3790074.f71d216eecca",
"projects/meshtastic-headscale-runbook.md.tmp.3790074.d94af273bec3",
"runbooks/expose-service-contabo.md.tmp.3790074.70782eb4562c",
"runbooks/expose-service-contabo.md.tmp.3790074.fe105eeb05b6",
"runbooks/expose-service-edge2.md.tmp.3790074.484208d24d9d",
"runbooks/expose-service-edge2.md.tmp.3790074.b2d7cda931c0",
"runbooks/expose-service-home.md.tmp.3790074.a7aea2f94658",
"runbooks/expose-service-home.md.tmp.3790074.b26454819896",
"docs/software/dns.md.tmp.3790074.fcdcf768c300",
"docs/software/dns.md.tmp.3790074.404f85bc78a4",
"projects/meshwars.md",
"projects/fleet-storage-memory-upgrade.md.tmp.2730138.81f9975eb3a6",
"runbooks/navi-lift-to-media.md.tmp.2730138.bee0e1488a4b",
"runbooks/navi-lift-to-media.md.tmp.2730138.cb383db7c987",
"runbooks/navi-lift-to-media.md.tmp.2730138.5755c5b630d8",
"runbooks/navi-lift-to-media.md.tmp.2730138.74d5fc239a82",
"projects/navi-recon-separation.md.tmp.2730138.1a9ee67ba5ca",
"runbooks/navi-lift-to-media.md",
"runbooks/navi-lift-to-media.md.tmp.2730138.56b7ce0eca2e",
"docs/hardware/environment.md.tmp.2730138.237b7072261a",
"docs/hardware/environment.md.tmp.2730138.58738aa3e22c",
"docs/hardware/environment.md.tmp.2730138.e8527bb48e1d",
"runbooks/edge2-boot-recovery.md",
"runbooks/corescope-ingest-stall-oom.md",
"projects/navi-recon-separation.md",
@ -234,7 +235,6 @@
"runbooks/central-deploy-cutover.md",
"runbooks/fleet-magicdns-resolved-migration.md",
"projects/fleet-platform-baseline.md",
"runbooks/toc-cortex-pve9.2-update.md",
"Untitled.canvas",
"assets/echo6yellow_logo_422x422_square.png",
"assets/echo6yellow_logo_422x81.png",

9
vault/docs/services/services.md
View file

@ -38,6 +38,7 @@ updated: 2026-08-14
| Headscale | edge2 (CT 107) | 100.64.0.38:8084 | https://vpn.echo6.co | Tailscale coordination (OIDC enabled) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** |
| Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** |
| Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place [[2026-06-19]]** |
| MeshWars Preview | utility (CT 113) | 192.168.1.113 / 100.64.0.39:8090 | https://mwpreview.k7zvx.com | Public preview of the unreleased `feat/places` MeshWars branch, running a periodically-refreshed read-only copy of production (CT 119) data; /admin and /api/admin/* return 404 on the public host, admin reachable only over the tailnet |
| Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager 1.37.1 (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) |
| Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet |
| Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) |
@ -170,6 +171,14 @@ updated: 2026-08-14
- Response: 175 char chunks × 3 messages max
- Compose path: `/home/zvx/meshai/docker-compose.yml`
### utility - CT 113 (192.168.1.113 / Tailscale: 100.64.0.39)
- MeshWars Preview — public preview instance of the `feat/places` branch (Docker, compose path `/home/zvx/meshwars/docker-compose.yml`)
- Fronted by utility [[caddy]] at https://mwpreview.k7zvx.com (Tailscale IP, /admin + /api/admin/* blocked with 404 on the public host)
- /admin still reachable directly over the tailnet at 100.64.0.39:8090/admin
- Database is a SQLite online-backup clone of CT 119's `game.db`, taken read-only; the `place` seed table is not present in production's schema yet and is auto-reloaded by the app on each restart after a clone
- ADMIN_TOKEN is unique to this container, generated fresh — never copied from production
- Join and check-in registration disabled by default
### utility - CT 118 (192.168.1.118)
- Signal/Matrix room archive bot (archivist.service via systemd)
- 1 core, 1GB RAM, 8GB disk

1
vault/docs/software/caddy.md
View file

@ -79,6 +79,7 @@ journalctl -u caddy -f
| lidarr.echo6.co | 100.64.0.18:8686 | Tailscale | lidarr music automation (Authentik forward auth) |
| navidrome.echo6.co | 100.64.0.18:4533 | Tailscale | navidrome music server (Authentik forward auth, /rest/* exempt for Subsonic API) |
| vpn.idahomesh.com | 192.168.1.106:8080 | Local IP | IdahoMesh Headscale VPN coordination |
| mwpreview.k7zvx.com | 100.64.0.39:8090 | Tailscale | MeshWars public preview (CT 113, feat/places branch; /admin + /api/admin/* blocked -- 404 -- on this public host, reachable only over tailnet) |
### Commands

60
vault/docs/software/dns.md
View file

@ -10,13 +10,32 @@ related:
- [[expose-service-contabo]]
- [[usenet]]
- [[expose-service-edge2]]
updated: 2026-07-13
updated: 2026-08-24
---
# GoDaddy DNS Management
## Script Location
`~/bin/godaddy-dns.py`
`~/bin/godaddy-dns.py` on **cortex** (100.64.0.14). Restored 2026-08-24 — the
original copy was lost in a host rebuild and these docs pointed at a script
that no longer existed anywhere on the fleet for some time; that cost real
time mid-deploy. Python 3 standard library only, no pip installs.
## THE RECORD-SET TRAP
GoDaddy's API has two kinds of write endpoints for A records:
- `PUT /v1/domains/<domain>/records/A/<name>` — replaces only `<name>`. Safe.
- `PUT /v1/domains/<domain>/records/A` and `PUT /v1/domains/<domain>/records`
— **replace every record of that type on the whole domain.**
Both `k7zvx.com` and `echo6.co` front live production services (mail, auth,
forge, vpn, vault, matrix, element, and more). Calling one of the record-SET
endpoints to "add" a record would wipe every other A record on the zone.
`godaddy-dns.py` only ever uses the single-record endpoint to write, and does
not implement the record-set endpoints at all. `add-a` always reads the full
A-record list before and after and prints a diff, so you can see nothing
else changed.
## API Credentials
@ -36,29 +55,34 @@ Stored in `/home/zvx/projects/.ref/credentials` as:
arclightvanguard.com, echo6.co, echo6.org, happylittlellc.com, idahomesh.com, k7zvx.com, lpmesh.com, maliceinwonderland.org, matthewwayne.com, smugglersden.co, underdogs.cc
## Subcommands
`godaddy-dns.py` currently supports A records only:
- `list <domain>` — list all A records for a domain
- `get-a <domain> <name>` — show the A record(s) for one name
- `add-a <domain> <name> <ip> [--ttl SECONDS] [--dry-run]` — add/update a
single A record via the safe single-record endpoint; prints a before/after
diff of the whole domain's A records
There is no CNAME/MX/delete/multi-domain support — add-a is add-or-update
(PUT to the single-record endpoint), and there is no destructive delete or
record-set command by design (see the trap above).
## Usage Examples
```bash
# List all domains
godaddy-dns.py list-domains
# List records for a domain
# List all A records for a domain
godaddy-dns.py list echo6.co
# Add A record
# Look up one record
godaddy-dns.py get-a echo6.co www
# Add/update an A record
godaddy-dns.py add-a echo6.co www 199.6.36.163
# Add CNAME record
godaddy-dns.py add-cname echo6.co blog www.echo6.co
# Add MX record with priority
godaddy-dns.py add-mx echo6.co mail.echo6.co --priority=10
# Delete record
godaddy-dns.py delete echo6.co A www
# Configure MX for all domains
godaddy-dns.py setup-mail
# Preview a change without writing anything
godaddy-dns.py add-a echo6.co www 199.6.36.163 --dry-run
```
## Common Patterns

6
vault/projects/meshtastic-headscale-runbook.md
View file

@ -10,7 +10,7 @@ related:
- [[meshtastic-sidecar-node]]
- [[headscale-onboard-node]]
- [[services]]
updated: 2026-07-13
updated: 2026-08-24
---
# IdahoMesh Tailnet Runbook
@ -471,8 +471,8 @@ systemctl reload caddy'
### 3.4 Add GoDaddy DNS Record
```bash
# On cortex/TOC
source /home/zvx/projects/.ref/credentials
# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
# credentials from .ref/credentials itself
godaddy-dns.py add-a idahomesh.com vpn 199.6.36.163
```

8
vault/runbooks/expose-service-contabo.md
View file

@ -10,7 +10,7 @@ related:
- [[lxc-service-migration]]
- [[caddy]]
- [[services]]
updated: 2026-07-13
updated: 2026-08-24
---
# Expose Service on Contabo
@ -34,12 +34,14 @@ docker compose up -d
### 2. Add DNS record
```bash
# On TOC
source /home/zvx/projects/.ref/credentials
# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
# credentials from .ref/credentials itself
godaddy-dns.py add-a echo6.co <service> 5.189.158.149
dig +short <service>.echo6.co @8.8.8.8 # Verify
```
See [[dns]] for the record-set trap and full subcommand list.
### 3. Add Caddy site block
```bash

8
vault/runbooks/expose-service-edge2.md
View file

@ -10,7 +10,7 @@ related:
- [[expose-service-home]]
- [[edge2-access-reference]]
- [[caddy]]
updated: 2026-07-13
updated: 2026-08-24
---
# Expose Service on edge2 (Contabo Cloud VPS)
@ -103,11 +103,13 @@ sudo systemctl reload caddy
**GoDaddy domains:**
```bash
# On cortex/toc
source /home/zvx/projects/.ref/credentials
# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
# credentials from .ref/credentials itself
godaddy-dns.py add-a <zone> <subdomain> 184.174.35.153
```
See [[dns]] for the record-set trap and full subcommand list.
**Cloudflare domains:**
Manual via Cloudflare dashboard (no API token):
1. A record → 184.174.35.153 (proxied / orange cloud)

9
vault/runbooks/expose-service-home.md
View file

@ -10,7 +10,7 @@ related:
- [[proxmox-onboard-node]]
- [[headscale-onboard-node]]
- [[ct-runbook]]
updated: 2026-07-13
updated: 2026-08-24
---
# Expose Service on Home Network
@ -86,11 +86,14 @@ systemctl reload caddy"
### 5. Add DNS record
```bash
# On TOC
source /home/zvx/projects/.ref/credentials
# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there
godaddy-dns.py add-a echo6.co <service> 199.6.36.163
```
`godaddy-dns.py` reads credentials from `.ref/credentials` itself — no need
to `source` it. See [[dns]] for the record-set trap and full subcommand
list (`list`, `get-a`, `add-a --dry-run`).
### 6. Update service CORS (if applicable)
Add `https://<service>.echo6.co` to the service's allowed origins.