From 586e16de889625e231133ea62e08d6547858db4d Mon Sep 17 00:00:00 2001 From: echo6-autocommit Date: Fri, 17 Jul 2026 18:00:20 +0000 Subject: [PATCH] auto: docs sync 2026-07-17T18:00:20+00:00 Files changed: vault/.obsidian/workspace.json vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/services/services.md vault/glossary.md vault/projects/fleet-patch-audit.md --- vault/.obsidian/workspace.json | 22 +++++++++++----------- vault/docs/hardware/environment.md | 10 +++++----- vault/docs/hardware/ip-allocation.md | 6 +++--- vault/docs/services/services.md | 3 ++- vault/glossary.md | 4 ++-- vault/projects/fleet-patch-audit.md | 10 +++++----- 6 files changed, 28 insertions(+), 27 deletions(-) diff --git a/vault/.obsidian/workspace.json b/vault/.obsidian/workspace.json index 3330521..d9af426 100644 --- a/vault/.obsidian/workspace.json +++ b/vault/.obsidian/workspace.json @@ -199,17 +199,17 @@ }, "active": "17bd4a6166f789d0", "lastOpenFiles": [ - "runbooks/central-deploy-cutover.md.tmp.1002651.75f56e212940", - "docs/software/central.md.tmp.1002651.11f9fdeacea8", - "runbooks/conduit-operations.md.tmp.1002651.8bca4793e607", - "runbooks/add-peertube-channel.md.tmp.767109.d14b6e68779c", - "runbooks/add-peertube-channel.md.tmp.767109.366b5b6ebfe2", - "runbooks/peertube-remote-runner.md.tmp.767109.9cf753daf1b2", - "runbooks/peertube-remote-runner.md.tmp.767109.f739384d8248", - "runbooks/peertube-remote-runner.md.tmp.767109.76833270c7a0", - "docs/hardware/environment.md.tmp.767109.4e9ed4494a50", - "docs/hardware/environment.md.tmp.767109.3462012af99e", - "docs/hardware/environment.md.tmp.767109.55addc2a6c2b", + "projects/fleet-patch-audit.md.tmp.3598161.730170652bdf", + "projects/fleet-patch-audit.md.tmp.3598161.d03a9fb9997e", + "projects/fleet-patch-audit.md.tmp.3598161.7f4127512795", + "projects/fleet-patch-audit.md.tmp.3598161.9e2c0bd025ae", + "projects/fleet-patch-audit.md.tmp.3598161.dc24c4c7df8b", + "projects/fleet-patch-audit.md.tmp.3598161.17f66ff46df8", + "docs/services/services.md.tmp.3598161.5e23f3a83462", + "docs/services/services.md.tmp.3598161.69bdec3ce793", + "glossary.md.tmp.3598161.3053e87ea7b8", + "glossary.md.tmp.3598161.9356baf31ea3", + "docs/hardware/ip-allocation.md.tmp.3598161.c2f90b7c0140", "runbooks/conduit-operations.md", "docs/software/conduit.md", "archive/projects/vaultwarden-plan.md", diff --git a/vault/docs/hardware/environment.md b/vault/docs/hardware/environment.md index e93b038..ed840d0 100644 --- a/vault/docs/hardware/environment.md +++ b/vault/docs/hardware/environment.md @@ -10,7 +10,7 @@ related: - [[headscale-onboard-node]] - [[proxmox-create-ubuntu-vm]] - [[toc-cortex-pve9.2-update]] -updated: 2026-07-16 +updated: 2026-07-17 --- # Echo6 Environment Reference @@ -113,7 +113,7 @@ Five nodes running Proxmox VE: | ha | 192.168.1.151 | 100.64.0.16 | Home Assistant (VM 151 on cloud, Docker, home automation) | | **edge1** (rebuilt Contabo VPS) | 5.189.158.149 | 100.64.0.40 | Debian 12 + Proxmox 8.4.19, **mail-only** — Mailcow in CT 101; host [[caddy]] + mailcow-dnat.service; rebuilt [[2026-06-19]] | -| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh | +| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com | *Last updated: [[2026-06-19]] — Contabo VPS rebuilt as edge1 (mail-only, Debian 12 + Proxmox 8.4.19, 5.189.158.149 / tailnet 100.64.0.40); Mailcow CT 101 (10.10.10.2) on edge1; edge2 is now the permanent front door for all other services; Headscale node `contabo` moved to 100.64.0.40; previously added edge2 CT 107 (headscale), CT 106 (matrix), CT 105 ([[authentik]]), CT 104 (livesync), CT 103 (forgejo), CT 102 (vaultwarden)* @@ -136,7 +136,7 @@ Five nodes running Proxmox VE: | mcc | media (CT 111) | 192.168.1.111 | 100.64.0.19 | pymc console web app ([[caddy]] + Postfix, /api+/auth+/ws → aida-nebra :8000) | | mailcow | edge1 (CT 101) | 10.10.10.2 | — | Mailcow email server (privileged LXC, mail-only host; reached via host DNAT + Caddy) | | pdm | edge2 (CT 100) | 10.10.10.10 | 100.64.0.28 | Proxmox Datacenter Manager | -| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | WordPress for intermountainmesh.com | +| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname `wordpress` unchanged; MariaDB purged — flat-file, no DB) | | vaultwarden | edge2 (CT 102) | 10.10.10.20 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) | | forgejo | edge2 (CT 103) | 10.10.10.21 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16) | | livesync | edge2 (CT 104) | 10.10.10.22 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) | @@ -190,7 +190,7 @@ Current registered nodes (25 total): | edge2 | 100.64.0.26 | Proxmox/Contabo VPS | | gl-a1300 | 100.64.0.29 | Router | | bluefin | 100.64.0.30 | Desktop | -| wordpress | 100.64.0.31 | LXC | +| wordpress | 100.64.0.31 | LXC (edge2 CT 101 — now runs Grav CMS; hostname unchanged) | | meshai | 100.64.0.32 | LXC | | vaultwarden | 100.64.0.33 | LXC (edge2 CT 102) | | forgejo | 100.64.0.34 | LXC (edge2 CT 103) — node id 46 | @@ -264,4 +264,4 @@ matt-desktop is accessible via local IP (192.168.1.254) or Tailscale (100.64.0.1 |---------|-----| | Home external (public services) | 199.6.36.163 | | edge1 (mail-only, rebuilt Contabo VPS) | 5.189.158.149 | -| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh/intermountainmesh) | 184.174.35.153 | +| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh.com) | 184.174.35.153 | diff --git a/vault/docs/hardware/ip-allocation.md b/vault/docs/hardware/ip-allocation.md index efd335d..a932493 100755 --- a/vault/docs/hardware/ip-allocation.md +++ b/vault/docs/hardware/ip-allocation.md @@ -10,7 +10,7 @@ related: - [[environment]] - [[glossary]] - [[headscale-onboard-node]] -updated: 2026-07-16 +updated: 2026-07-17 --- # Echo6 Network IP Allocation @@ -71,12 +71,12 @@ edge1 (rebuilt Contabo VPS, 5.189.158.149 / Tailscale 100.64.0.40) runs Debian 1 ### edge2 LXC Containers (10.10.10.x, vmbr0) — permanent front door (184.174.35.153) -edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh. +edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com. | IP | Container | CTID | Tailscale | Purpose | |----|-----------|------|-----------|---------| | 10.10.10.10 | pdm | CT 100 | 100.64.0.28 | Proxmox Datacenter Manager | -| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | WordPress for intermountainmesh.com | +| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname unchanged; MariaDB purged — no DB) | | 10.10.10.20 | vaultwarden | CT 102 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) | | 10.10.10.21 | forgejo | CT 103 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16); git SSH → edge2 forgejo-ssh-dnat.service | | 10.10.10.22 | livesync | CT 104 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) | diff --git a/vault/docs/services/services.md b/vault/docs/services/services.md index 337df4a..2d49610 100644 --- a/vault/docs/services/services.md +++ b/vault/docs/services/services.md @@ -10,7 +10,7 @@ related: - [[lxc-service-migration]] - [[meshtastic-headscale-runbook]] - [[expose-service-edge2]] -updated: 2026-07-13 +updated: 2026-07-17 --- # Current Services Inventory @@ -39,6 +39,7 @@ updated: 2026-07-13 | Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host Caddy — **migrated from Contabo 2026-06-19** | | Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place 2026-06-19** | | Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) | +| Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet | | Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) | | Proxmox VE | data node | 192.168.1.240:8006 | https://proxmox.echo6.co | Cluster web UI (via Caddy+Tailscale) | | Immich | cloud (CT 120) | 192.168.1.182:2283 | https://immich.echo6.co | Photo management (Docker, NFS storage on pi-nas) | diff --git a/vault/glossary.md b/vault/glossary.md index ab2b4db..ccb399e 100644 --- a/vault/glossary.md +++ b/vault/glossary.md @@ -10,7 +10,7 @@ related: - [[caddy]] - [[edge2-access-reference]] - [[proxmox-onboard-node]] -updated: 2026-07-13 +updated: 2026-07-17 --- # Glossary & Vocabulary @@ -68,7 +68,7 @@ mesh · matrix · [[recon]] · media · auth · [[dns]] · vpn · storage · pro - **pdm** — aliases: 10.10.10.10, CT 100, 100.64.0.28 — on: edge2 - **[[searxng]]** — aliases: 192.168.1.102, CT 102, 100.64.0.15 — on: utility - **vaultwarden** — aliases: 10.10.10.20, CT 102, 100.64.0.33 — on: edge2 -- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2 +- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2 (hostname unchanged; runs Grav CMS since 2026-07-17, not WordPress — MariaDB removed) ### Raspberry Pi / Edge nodes diff --git a/vault/projects/fleet-patch-audit.md b/vault/projects/fleet-patch-audit.md index dab8bbb..4986a50 100644 --- a/vault/projects/fleet-patch-audit.md +++ b/vault/projects/fleet-patch-audit.md @@ -10,7 +10,7 @@ related: - [[caddy]] - [[services]] - [[ip-allocation]] -updated: 2026-07-13 +updated: 2026-07-17 status: complete --- @@ -18,7 +18,7 @@ status: complete Read-only audit snapshot as of 2026-06-19. **Nothing has been applied — this is a planning document to build the patch plan from.** -**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149). +**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149). **CT101 update (2026-07-17):** migrated from WordPress/MariaDB to **Grav CMS 2.0.11** (flat-file, no database — MariaDB purged from the container); serves idahomesh.com (not intermountainmesh.com — that domain has always been parked at a third party and never reached this container); hostname `wordpress` unchanged. See [[environment]] / [[services]] for current state. All WordPress/MariaDB references below reflect the pre-migration state as audited on 2026-06-19 and are left as historical record. --- @@ -143,7 +143,7 @@ Running application version vs latest stable upstream, per app — the "is every ### Current / already past the fix (no action) -Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm). +Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101 — **superseded 2026-07-17, see topology note above**) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm). ### Lower urgency @@ -747,7 +747,7 @@ Complete point-in-time state of every node, guest, and container service. | CT | Name | Services / Status | |----|------|-------------------| | CT100 | pdm | PDM 1.1.4, current (native) | -| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI | +| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI (**superseded 2026-07-17 — migrated to Grav CMS, MariaDB removed; see topology note above**) | | CT102 | vaultwarden | vaultwarden/server:latest — drift indeterminate | | CT103 | forgejo | 14.0.5 (forgejo:14 + postgres:16-alpine drifted) | | CT104 | livesync | couchdb:3.4 drifted + local provisioner | @@ -762,5 +762,5 @@ Complete point-in-time state of every node, guest, and container service. - **Complete:** all five PVE-9 nodes (data, utility, cloud, media, toc), edge2, cortex, pi-nas, and all discovered guests/containers. - **Excluded:** edge1 (the rebuilt ex-Contabo, mail-only) — mid-rebuild/maintenance at time of audit; re-audit once it settles. -- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed. +- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed. (Moot as of 2026-07-17 — CT101 migrated to Grav CMS, no plugins/DB; see topology note above.) - **Method:** read-only throughout — SSH / `pct exec`, `apt list --upgradable`, `docker manifest inspect` for same-tag drift. Floating/pinned-tag caveats noted inline where drift could not be confirmed.