auto: docs sync 2026-08-24T06:00:04+00:00

Files changed: engine/lint-report.md vault/.obsidian/workspace.json vault/docs/services/services.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/projects/meshtastic-headscale-runbook.md vault/runbooks/expose-service-contabo.md vault/runbooks/expose-service-edge2.md vault/runbooks/expose-service-home.md

engine/lint-report.md

@@ -1,6 +1,6 @@
 # Vault Lint Report
 
-Generated: 2026-08-23T18:00:04Z  |  Docs scanned: 116  |  Elapsed: 0.0s
+Generated: 2026-08-24T05:59:56Z  |  Docs scanned: 116  |  Elapsed: 0.0s
 
 ## Summary
 

vault/.obsidian/workspace.json

@@ -199,18 +199,19 @@
   },
   "active": "17bd4a6166f789d0",
   "lastOpenFiles": [
+    "projects/meshtastic-headscale-runbook.md.tmp.3790074.f71d216eecca",
+    "projects/meshtastic-headscale-runbook.md.tmp.3790074.d94af273bec3",
+    "runbooks/expose-service-contabo.md.tmp.3790074.70782eb4562c",
+    "runbooks/expose-service-contabo.md.tmp.3790074.fe105eeb05b6",
+    "runbooks/expose-service-edge2.md.tmp.3790074.484208d24d9d",
+    "runbooks/expose-service-edge2.md.tmp.3790074.b2d7cda931c0",
+    "runbooks/expose-service-home.md.tmp.3790074.a7aea2f94658",
+    "runbooks/expose-service-home.md.tmp.3790074.b26454819896",
+    "docs/software/dns.md.tmp.3790074.fcdcf768c300",
+    "docs/software/dns.md.tmp.3790074.404f85bc78a4",
     "projects/meshwars.md",
     "projects/fleet-storage-memory-upgrade.md.tmp.2730138.81f9975eb3a6",
-    "runbooks/navi-lift-to-media.md.tmp.2730138.bee0e1488a4b",
-    "runbooks/navi-lift-to-media.md.tmp.2730138.cb383db7c987",
-    "runbooks/navi-lift-to-media.md.tmp.2730138.5755c5b630d8",
-    "runbooks/navi-lift-to-media.md.tmp.2730138.74d5fc239a82",
-    "projects/navi-recon-separation.md.tmp.2730138.1a9ee67ba5ca",
     "runbooks/navi-lift-to-media.md",
-    "runbooks/navi-lift-to-media.md.tmp.2730138.56b7ce0eca2e",
-    "docs/hardware/environment.md.tmp.2730138.237b7072261a",
-    "docs/hardware/environment.md.tmp.2730138.58738aa3e22c",
-    "docs/hardware/environment.md.tmp.2730138.e8527bb48e1d",
     "runbooks/edge2-boot-recovery.md",
     "runbooks/corescope-ingest-stall-oom.md",
     "projects/navi-recon-separation.md",
@@ -234,7 +235,6 @@
     "runbooks/central-deploy-cutover.md",
     "runbooks/fleet-magicdns-resolved-migration.md",
     "projects/fleet-platform-baseline.md",
-    "runbooks/toc-cortex-pve9.2-update.md",
     "Untitled.canvas",
     "assets/echo6yellow_logo_422x422_square.png",
     "assets/echo6yellow_logo_422x81.png",

vault/docs/services/services.md

@@ -38,6 +38,7 @@ updated: 2026-08-14
 | Headscale | edge2 (CT 107) | 100.64.0.38:8084 | https://vpn.echo6.co | Tailscale coordination (OIDC enabled) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** |
 | Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host [[caddy]] — **migrated from Contabo [[2026-06-19]]** |
 | Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place [[2026-06-19]]** |
+| MeshWars Preview | utility (CT 113) | 192.168.1.113 / 100.64.0.39:8090 | https://mwpreview.k7zvx.com | Public preview of the unreleased `feat/places` MeshWars branch, running a periodically-refreshed read-only copy of production (CT 119) data; /admin and /api/admin/* return 404 on the public host, admin reachable only over the tailnet |
 | Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager 1.37.1 (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) |
 | Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet |
 | Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) |
@@ -170,6 +171,14 @@ updated: 2026-08-14
 - Response: 175 char chunks × 3 messages max
 - Compose path: `/home/zvx/meshai/docker-compose.yml`
 
+### utility - CT 113 (192.168.1.113 / Tailscale: 100.64.0.39)
+- MeshWars Preview — public preview instance of the `feat/places` branch (Docker, compose path `/home/zvx/meshwars/docker-compose.yml`)
+- Fronted by utility [[caddy]] at https://mwpreview.k7zvx.com (Tailscale IP, /admin + /api/admin/* blocked with 404 on the public host)
+- /admin still reachable directly over the tailnet at 100.64.0.39:8090/admin
+- Database is a SQLite online-backup clone of CT 119's `game.db`, taken read-only; the `place` seed table is not present in production's schema yet and is auto-reloaded by the app on each restart after a clone
+- ADMIN_TOKEN is unique to this container, generated fresh — never copied from production
+- Join and check-in registration disabled by default
+
 ### utility - CT 118 (192.168.1.118)
 - Signal/Matrix room archive bot (archivist.service via systemd)
 - 1 core, 1GB RAM, 8GB disk

vault/docs/software/caddy.md

@@ -79,6 +79,7 @@ journalctl -u caddy -f
 | lidarr.echo6.co | 100.64.0.18:8686 | Tailscale | lidarr music automation (Authentik forward auth) |
 | navidrome.echo6.co | 100.64.0.18:4533 | Tailscale | navidrome music server (Authentik forward auth, /rest/* exempt for Subsonic API) |
 | vpn.idahomesh.com | 192.168.1.106:8080 | Local IP | IdahoMesh Headscale VPN coordination |
+| mwpreview.k7zvx.com | 100.64.0.39:8090 | Tailscale | MeshWars public preview (CT 113, feat/places branch; /admin + /api/admin/* blocked -- 404 -- on this public host, reachable only over tailnet) |
 
 ### Commands
 

vault/docs/software/dns.md

@@ -10,13 +10,32 @@ related:
   - [[expose-service-contabo]]
   - [[usenet]]
   - [[expose-service-edge2]]
-updated: 2026-07-13
+updated: 2026-08-24
 ---
 # GoDaddy DNS Management
 
 ## Script Location
 
-`~/bin/godaddy-dns.py`
+`~/bin/godaddy-dns.py` on **cortex** (100.64.0.14). Restored 2026-08-24 — the
+original copy was lost in a host rebuild and these docs pointed at a script
+that no longer existed anywhere on the fleet for some time; that cost real
+time mid-deploy. Python 3 standard library only, no pip installs.
+
+## THE RECORD-SET TRAP
+
+GoDaddy's API has two kinds of write endpoints for A records:
+
+- `PUT /v1/domains/<domain>/records/A/<name>` — replaces only `<name>`. Safe.
+- `PUT /v1/domains/<domain>/records/A` and `PUT /v1/domains/<domain>/records`
+  — **replace every record of that type on the whole domain.**
+
+Both `k7zvx.com` and `echo6.co` front live production services (mail, auth,
+forge, vpn, vault, matrix, element, and more). Calling one of the record-SET
+endpoints to "add" a record would wipe every other A record on the zone.
+`godaddy-dns.py` only ever uses the single-record endpoint to write, and does
+not implement the record-set endpoints at all. `add-a` always reads the full
+A-record list before and after and prints a diff, so you can see nothing
+else changed.
 
 ## API Credentials
 
@@ -36,29 +55,34 @@ Stored in `/home/zvx/projects/.ref/credentials` as:
 
 arclightvanguard.com, echo6.co, echo6.org, happylittlellc.com, idahomesh.com, k7zvx.com, lpmesh.com, maliceinwonderland.org, matthewwayne.com, smugglersden.co, underdogs.cc
 
+## Subcommands
+
+`godaddy-dns.py` currently supports A records only:
+
+- `list <domain>` — list all A records for a domain
+- `get-a <domain> <name>` — show the A record(s) for one name
+- `add-a <domain> <name> <ip> [--ttl SECONDS] [--dry-run]` — add/update a
+  single A record via the safe single-record endpoint; prints a before/after
+  diff of the whole domain's A records
+
+There is no CNAME/MX/delete/multi-domain support — add-a is add-or-update
+(PUT to the single-record endpoint), and there is no destructive delete or
+record-set command by design (see the trap above).
+
 ## Usage Examples
 
 ```bash
-# List all domains
+# List all A records for a domain
-godaddy-dns.py list-domains
-
-# List records for a domain
 godaddy-dns.py list echo6.co
 
-# Add A record
+# Look up one record
+godaddy-dns.py get-a echo6.co www
+
+# Add/update an A record
 godaddy-dns.py add-a echo6.co www 199.6.36.163
 
-# Add CNAME record
+# Preview a change without writing anything
-godaddy-dns.py add-cname echo6.co blog www.echo6.co
+godaddy-dns.py add-a echo6.co www 199.6.36.163 --dry-run
-
-# Add MX record with priority
-godaddy-dns.py add-mx echo6.co mail.echo6.co --priority=10
-
-# Delete record
-godaddy-dns.py delete echo6.co A www
-
-# Configure MX for all domains
-godaddy-dns.py setup-mail
 ```
 
 ## Common Patterns

vault/projects/meshtastic-headscale-runbook.md

@@ -10,7 +10,7 @@ related:
   - [[meshtastic-sidecar-node]]
   - [[headscale-onboard-node]]
   - [[services]]
-updated: 2026-07-13
+updated: 2026-08-24
 ---
 # IdahoMesh Tailnet Runbook
 
@@ -471,8 +471,8 @@ systemctl reload caddy'
 ### 3.4 Add GoDaddy DNS Record
 
 ```bash
-# On cortex/TOC
+# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
-source /home/zvx/projects/.ref/credentials
+# credentials from .ref/credentials itself
 godaddy-dns.py add-a idahomesh.com vpn 199.6.36.163
 ```
 

vault/runbooks/expose-service-contabo.md

@@ -10,7 +10,7 @@ related:
   - [[lxc-service-migration]]
   - [[caddy]]
   - [[services]]
-updated: 2026-07-13
+updated: 2026-08-24
 ---
 # Expose Service on Contabo
 
@@ -34,12 +34,14 @@ docker compose up -d
 ### 2. Add DNS record
 
 ```bash
-# On TOC
+# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
-source /home/zvx/projects/.ref/credentials
+# credentials from .ref/credentials itself
 godaddy-dns.py add-a echo6.co <service> 5.189.158.149
 dig +short <service>.echo6.co @8.8.8.8  # Verify
 ```
 
+See [[dns]] for the record-set trap and full subcommand list.
+
 ### 3. Add Caddy site block
 
 ```bash

vault/runbooks/expose-service-edge2.md

@@ -10,7 +10,7 @@ related:
   - [[expose-service-home]]
   - [[edge2-access-reference]]
   - [[caddy]]
-updated: 2026-07-13
+updated: 2026-08-24
 ---
 # Expose Service on edge2 (Contabo Cloud VPS)
 
@@ -103,11 +103,13 @@ sudo systemctl reload caddy
 
 **GoDaddy domains:**
 ```bash
-# On cortex/toc
+# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there and reads
-source /home/zvx/projects/.ref/credentials
+# credentials from .ref/credentials itself
 godaddy-dns.py add-a <zone> <subdomain> 184.174.35.153
 ```
 
+See [[dns]] for the record-set trap and full subcommand list.
+
 **Cloudflare domains:**
 Manual via Cloudflare dashboard (no API token):
 1. A record → 184.174.35.153 (proxied / orange cloud)

vault/runbooks/expose-service-home.md

@@ -10,7 +10,7 @@ related:
   - [[proxmox-onboard-node]]
   - [[headscale-onboard-node]]
   - [[ct-runbook]]
-updated: 2026-07-13
+updated: 2026-08-24
 ---
 # Expose Service on Home Network
 
@@ -86,11 +86,14 @@ systemctl reload caddy"
 ### 5. Add DNS record
 
 ```bash
-# On TOC
+# On cortex — godaddy-dns.py lives at ~/bin/godaddy-dns.py there
-source /home/zvx/projects/.ref/credentials
 godaddy-dns.py add-a echo6.co <service> 199.6.36.163
 ```
 
+`godaddy-dns.py` reads credentials from `.ref/credentials` itself — no need
+to `source` it. See [[dns]] for the record-set trap and full subcommand
+list (`list`, `get-a`, `add-a --dry-run`).
+
 ### 6. Update service CORS (if applicable)
 
 Add `https://<service>.echo6.co` to the service's allowed origins.