matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auto: docs sync 2026-06-22T00:00:08+00:00

Browse source 
Files changed: engine/lint-report.md vault/.obsidian/workspace.json vault/projects/fleet-patch-audit.md
This commit is contained in:
echo6-autocommit 2026-06-22 00:00:08 +00:00
commit 277ac1194b
3 changed files with 29 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

38
vault/projects/fleet-patch-audit.md
View file

@ -150,7 +150,7 @@ Lowest-risk changes first; everything reboot-bearing deferred to scheduled windo
|------|-------|---------|-------|
| **1 — Guest/VM security apt** | utility CT100,101,102,103,104,106,107,108,109,112,118,119 · cloud CT120,121 · media VM105,CT110,CT111 · data VM1130 · edge2 CT100–107 | No | Lowest blast radius. Worst-first: CT119, CT108, immich/nextcloud guest-OS, peertube. |
| **2 — Hypervisor host OS security** | data, utility, cloud, media host OSes (**not toc**) | No | One node at a time; restarts hypervisor-side daemons (smbd etc.). edge2 host already patched. |
| **3 — App / container updates (Tier 2)** | per-app, native updater each | Per-app | **Substantially complete 2026-06-21** — all security-critical apps done; low-urgency batch + cortex AI stack remain. See Phase 2 Execution Log and "special handling" below. |
| **3 — App / container updates (Tier 2)** | per-app, native updater each | Per-app | **COMPLETE 2026-06-21** — all app upgrades done (security-critical, low-urgency batch, and cortex AI stack). See Phase 2 Execution Log. |
| **4 — Reboot windows (Tier 3)** | PVE 9.2 + QEMU 11 + LXC 7 + kernel on the 5 PVE-9 nodes; pi-nas kernel + OMV; cortex NVIDIA/DKMS | **Yes** | Schedule deliberately; toc+cortex coordinated. |
| **Cross-cutting** | Tailscale 1.94→1.98 fleet-wide | No | Can ride along Phase 1/2. |
@ -264,7 +264,7 @@ Headscale stale-node cleanup: deleted dead nodes `mailcow` (destroyed CT108) and
## Phase 2 — Execution Log (2026-06-21)
**Status: substantially complete; paused 2026-06-21.** All high-priority and security-critical app upgrades are done. Only the low-urgency batch items and the cortex AI stack (protected host, own window) remain.
**Status: COMPLETE (2026-06-21).** All app upgrades done — high-priority, security-critical, low-urgency batch, and cortex AI stack. Only Phase 3 (platform/reboots) and the deferred Nominatim project remain.
### Completed upgrades
@ -320,21 +320,33 @@ Empirically confirmed during the OTS update: updating OTS to 1.7.12 does **not**
- **Radarr:** set up a `\\192.168.1.160\manual` SMB drop folder on the same NFS export as the library (atomic-move imports) for manual movie filing.
- **Snapshot hygiene:** all rollback snapshots cleaned up after validation — Phase 1 `presec-*`, Phase 2 `prewave2-*`, OTS `pre-ots-*` snapshots all removed.
### Remaining work (next session)
### Completed — low-urgency batch and cortex AI stack
**Low-urgency batch:**
- Caddy (edge2 CT101)
- CouchDB 3.4 → 3.5 (livesync CT104 edge2)
- valkey-8 sidecar (searxng CT102)
- NATS 2.14.0 → 2.14.2 (central CT104 utility)
- MediaMTX 1.13 → 1.19 + Mumble on CT109 (OTS companions, separate from the OTS app)
**Low-urgency batch — DONE:**
- Caddy (utility CT101): 2.10.2 → 2.11.4
- CouchDB (edge2 CT104 livesync): 3.4 → 3.5.2 — all 5 DBs intact
- valkey-8 sidecar (utility CT102 searxng): bumped to latest 8.x
- NATS (utility CT104 central): 2.14.0 → 2.14.2 — all 12 JetStream streams intact
- MediaMTX (CT109): 1.13.0 → 1.19.1
- Mumble (CT109): already latest in Ubuntu repo (1.5.517 — no upstream action possible without going off-distro)
**Protected host — own deliberate window:**
- cortex AI stack: ollama 0.16 → 0.30, open-webui, qdrant, TEI
**cortex AI stack — DONE** (protected host; containers only; NO reboot, NO driver touch):
- qdrant: 1.16.3 → 1.18.2
- tei: 1.7 → 1.9 (bge-m3 on GPU)
- ollama: 0.16.1 → 0.30.10 (vault-tagger 100% GPU)
- open-webui: 0.8.1 → 0.9.6
- Both `.ref` vault-engine deps (ollama vault-tagger + tei bge-m3) confirmed working on GPU.
### Minor follow-ups noted (non-urgent)
- **Caddy expired cert:** Caddy flagged an EXPIRED unmanaged cert for `navidrome.echo6.co` (pre-existing condition, not caused by the upgrade) — fix if that hostname matters.
- **MediaMTX deprecated config params:** 1.19 uses deprecated param names (`protocols` → `rtspTransports`, `encryption` → `rtspEncryption`) — works now (warnings only); rename before a future MediaMTX release removes them.
- **Rollback artifact cleanup:** retained rollback artifacts to clean once comfortable: `/root` DB dumps on their respective CTs (authentik hop1/2/3, forgejo, headscale107, immich, peertube, OTS), binary backups (caddy.bak, nats-server.bak, mediamtx.bak on their CTs), and openwebui DB backup on cortex (`/home/zvx/openwebui-webui.db.bak-20260621`).
- **Vestigial utility exit-node route:** stale 0.0.0.0/0 exit-node route on utility — optional cleanup (harmless post-0.29 Headscale).
### Separate deferred projects
**Separate deferred projects:**
- Nominatim v5 re-import — see [[nominatim-v5-reimport]]
- Optional: clean up retained `/root` DB dumps (authentik hop1/2/3, forgejo, headscale, OTS, immich, peertube, etc.) once upgrades are confirmed stable
---