matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auto: docs sync 2026-07-17T18:00:20+00:00

Browse source 
Files changed: vault/.obsidian/workspace.json vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/services/services.md vault/glossary.md vault/projects/fleet-patch-audit.md
This commit is contained in:
echo6-autocommit 2026-07-17 18:00:20 +00:00
commit 586e16de88
6 changed files with 28 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

22
vault/.obsidian/workspace.json vendored
View file

@ -199,17 +199,17 @@
},
"active": "17bd4a6166f789d0",
"lastOpenFiles": [
"runbooks/central-deploy-cutover.md.tmp.1002651.75f56e212940",
"docs/software/central.md.tmp.1002651.11f9fdeacea8",
"runbooks/conduit-operations.md.tmp.1002651.8bca4793e607",
"runbooks/add-peertube-channel.md.tmp.767109.d14b6e68779c",
"runbooks/add-peertube-channel.md.tmp.767109.366b5b6ebfe2",
"runbooks/peertube-remote-runner.md.tmp.767109.9cf753daf1b2",
"runbooks/peertube-remote-runner.md.tmp.767109.f739384d8248",
"runbooks/peertube-remote-runner.md.tmp.767109.76833270c7a0",
"docs/hardware/environment.md.tmp.767109.4e9ed4494a50",
"docs/hardware/environment.md.tmp.767109.3462012af99e",
"docs/hardware/environment.md.tmp.767109.55addc2a6c2b",
"projects/fleet-patch-audit.md.tmp.3598161.730170652bdf",
"projects/fleet-patch-audit.md.tmp.3598161.d03a9fb9997e",
"projects/fleet-patch-audit.md.tmp.3598161.7f4127512795",
"projects/fleet-patch-audit.md.tmp.3598161.9e2c0bd025ae",
"projects/fleet-patch-audit.md.tmp.3598161.dc24c4c7df8b",
"projects/fleet-patch-audit.md.tmp.3598161.17f66ff46df8",
"docs/services/services.md.tmp.3598161.5e23f3a83462",
"docs/services/services.md.tmp.3598161.69bdec3ce793",
"glossary.md.tmp.3598161.3053e87ea7b8",
"glossary.md.tmp.3598161.9356baf31ea3",
"docs/hardware/ip-allocation.md.tmp.3598161.c2f90b7c0140",
"runbooks/conduit-operations.md",
"docs/software/conduit.md",
"archive/projects/vaultwarden-plan.md",

10
vault/docs/hardware/environment.md
View file

@ -10,7 +10,7 @@ related:
- [[headscale-onboard-node]]
- [[proxmox-create-ubuntu-vm]]
- [[toc-cortex-pve9.2-update]]
updated: 2026-07-16
updated: 2026-07-17
---
# Echo6 Environment Reference
@ -113,7 +113,7 @@ Five nodes running Proxmox VE:
| ha | 192.168.1.151 | 100.64.0.16 | Home Assistant (VM 151 on cloud, Docker, home automation) |
| **edge1** (rebuilt Contabo VPS) | 5.189.158.149 | 100.64.0.40 | Debian 12 + Proxmox 8.4.19, **mail-only** — Mailcow in CT 101; host [[caddy]] + mailcow-dnat.service; rebuilt [[2026-06-19]] |
| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh |
| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com |
*Last updated: [[2026-06-19]] — Contabo VPS rebuilt as edge1 (mail-only, Debian 12 + Proxmox 8.4.19, 5.189.158.149 / tailnet 100.64.0.40); Mailcow CT 101 (10.10.10.2) on edge1; edge2 is now the permanent front door for all other services; Headscale node `contabo` moved to 100.64.0.40; previously added edge2 CT 107 (headscale), CT 106 (matrix), CT 105 ([[authentik]]), CT 104 (livesync), CT 103 (forgejo), CT 102 (vaultwarden)*
@ -136,7 +136,7 @@ Five nodes running Proxmox VE:
| mcc | media (CT 111) | 192.168.1.111 | 100.64.0.19 | pymc console web app ([[caddy]] + Postfix, /api+/auth+/ws → aida-nebra :8000) |
| mailcow | edge1 (CT 101) | 10.10.10.2 | — | Mailcow email server (privileged LXC, mail-only host; reached via host DNAT + Caddy) |
| pdm | edge2 (CT 100) | 10.10.10.10 | 100.64.0.28 | Proxmox Datacenter Manager |
| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | WordPress for intermountainmesh.com |
| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname `wordpress` unchanged; MariaDB purged — flat-file, no DB) |
| vaultwarden | edge2 (CT 102) | 10.10.10.20 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) |
| forgejo | edge2 (CT 103) | 10.10.10.21 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16) |
| livesync | edge2 (CT 104) | 10.10.10.22 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) |
@ -190,7 +190,7 @@ Current registered nodes (25 total):
| edge2 | 100.64.0.26 | Proxmox/Contabo VPS |
| gl-a1300 | 100.64.0.29 | Router |
| bluefin | 100.64.0.30 | Desktop |
| wordpress | 100.64.0.31 | LXC |
| wordpress | 100.64.0.31 | LXC (edge2 CT 101 — now runs Grav CMS; hostname unchanged) |
| meshai | 100.64.0.32 | LXC |
| vaultwarden | 100.64.0.33 | LXC (edge2 CT 102) |
| forgejo | 100.64.0.34 | LXC (edge2 CT 103) — node id 46 |
@ -264,4 +264,4 @@ matt-desktop is accessible via local IP (192.168.1.254) or Tailscale (100.64.0.1
|---------|-----|
| Home external (public services) | 199.6.36.163 |
| edge1 (mail-only, rebuilt Contabo VPS) | 5.189.158.149 |
| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh/intermountainmesh) | 184.174.35.153 |
| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh.com) | 184.174.35.153 |

6
vault/docs/hardware/ip-allocation.md
View file

@ -10,7 +10,7 @@ related:
- [[environment]]
- [[glossary]]
- [[headscale-onboard-node]]
updated: 2026-07-16
updated: 2026-07-17
---
# Echo6 Network IP Allocation
@ -71,12 +71,12 @@ edge1 (rebuilt Contabo VPS, 5.189.158.149 / Tailscale 100.64.0.40) runs Debian 1
### edge2 LXC Containers (10.10.10.x, vmbr0) — permanent front door (184.174.35.153)
edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh.
edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com.
| IP | Container | CTID | Tailscale | Purpose |
|----|-----------|------|-----------|---------|
| 10.10.10.10 | pdm | CT 100 | 100.64.0.28 | Proxmox Datacenter Manager |
| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | WordPress for intermountainmesh.com |
| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname unchanged; MariaDB purged — no DB) |
| 10.10.10.20 | vaultwarden | CT 102 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) |
| 10.10.10.21 | forgejo | CT 103 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16); git SSH → edge2 forgejo-ssh-dnat.service |
| 10.10.10.22 | livesync | CT 104 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) |

3
vault/docs/services/services.md
View file

@ -10,7 +10,7 @@ related:
- [[lxc-service-migration]]
- [[meshtastic-headscale-runbook]]
- [[expose-service-edge2]]
updated: 2026-07-13
updated: 2026-07-17
---
# Current Services Inventory
@ -39,6 +39,7 @@ updated: 2026-07-13
| Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host Caddy — **migrated from Contabo 2026-06-19** |
| Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place 2026-06-19** |
| Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) |
| Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet |
| Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) |
| Proxmox VE | data node | 192.168.1.240:8006 | https://proxmox.echo6.co | Cluster web UI (via Caddy+Tailscale) |
| Immich | cloud (CT 120) | 192.168.1.182:2283 | https://immich.echo6.co | Photo management (Docker, NFS storage on pi-nas) |

4
vault/glossary.md
View file

@ -10,7 +10,7 @@ related:
- [[caddy]]
- [[edge2-access-reference]]
- [[proxmox-onboard-node]]
updated: 2026-07-13
updated: 2026-07-17
---
# Glossary & Vocabulary
@ -68,7 +68,7 @@ mesh · matrix · [[recon]] · media · auth · [[dns]] · vpn · storage · pro
- **pdm** — aliases: 10.10.10.10, CT 100, 100.64.0.28 — on: edge2
- **[[searxng]]** — aliases: 192.168.1.102, CT 102, 100.64.0.15 — on: utility
- **vaultwarden** — aliases: 10.10.10.20, CT 102, 100.64.0.33 — on: edge2
- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2
- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2 (hostname unchanged; runs Grav CMS since 2026-07-17, not WordPress — MariaDB removed)
### Raspberry Pi / Edge nodes

10
vault/projects/fleet-patch-audit.md
View file

@ -10,7 +10,7 @@ related:
- [[caddy]]
- [[services]]
- [[ip-allocation]]
updated: 2026-07-13
updated: 2026-07-17
status: complete
---
@ -18,7 +18,7 @@ status: complete
Read-only audit snapshot as of 2026-06-19. **Nothing has been applied — this is a planning document to build the patch plan from.**
**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149).
**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149). **CT101 update (2026-07-17):** migrated from WordPress/MariaDB to **Grav CMS 2.0.11** (flat-file, no database — MariaDB purged from the container); serves idahomesh.com (not intermountainmesh.com — that domain has always been parked at a third party and never reached this container); hostname `wordpress` unchanged. See [[environment]] / [[services]] for current state. All WordPress/MariaDB references below reflect the pre-migration state as audited on 2026-06-19 and are left as historical record.
---
@ -143,7 +143,7 @@ Running application version vs latest stable upstream, per app — the "is every
### Current / already past the fix (no action)
Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101 — **superseded 2026-07-17, see topology note above**) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
### Lower urgency
@ -747,7 +747,7 @@ Complete point-in-time state of every node, guest, and container service.
| CT | Name | Services / Status |
|----|------|-------------------|
| CT100 | pdm | PDM 1.1.4, current (native) |
| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI |
| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI (**superseded 2026-07-17 — migrated to Grav CMS, MariaDB removed; see topology note above**) |
| CT102 | vaultwarden | vaultwarden/server:latest — drift indeterminate |
| CT103 | forgejo | 14.0.5 (forgejo:14 + postgres:16-alpine drifted) |
| CT104 | livesync | couchdb:3.4 drifted + local provisioner |
@ -762,5 +762,5 @@ Complete point-in-time state of every node, guest, and container service.
- **Complete:** all five PVE-9 nodes (data, utility, cloud, media, toc), edge2, cortex, pi-nas, and all discovered guests/containers.
- **Excluded:** edge1 (the rebuilt ex-Contabo, mail-only) — mid-rebuild/maintenance at time of audit; re-audit once it settles.
- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed.
- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed. (Moot as of 2026-07-17 — CT101 migrated to Grav CMS, no plugins/DB; see topology note above.)
- **Method:** read-only throughout — SSH / `pct exec`, `apt list --upgradable`, `docker manifest inspect` for same-tag drift. Floating/pinned-tag caveats noted inline where drift could not be confirmed.