auto: docs sync 2026-07-17T18:00:20+00:00

Files changed: vault/.obsidian/workspace.json vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/services/services.md vault/glossary.md vault/projects/fleet-patch-audit.md
2026-07-17 18:00:20 +00:00 · 2026-07-17 18:00:20 +00:00 · 586e16de88
commit 586e16de88
parent 9f2e20a6a1
6 changed files with 28 additions and 27 deletions
--- a/vault/.obsidian/workspace.json
+++ b/vault/.obsidian/workspace.json
@ -199,17 +199,17 @@
  },
  "active": "17bd4a6166f789d0",
  "lastOpenFiles": [
-    "runbooks/central-deploy-cutover.md.tmp.1002651.75f56e212940",
+    "projects/fleet-patch-audit.md.tmp.3598161.730170652bdf",
-    "docs/software/central.md.tmp.1002651.11f9fdeacea8",
+    "projects/fleet-patch-audit.md.tmp.3598161.d03a9fb9997e",
-    "runbooks/conduit-operations.md.tmp.1002651.8bca4793e607",
+    "projects/fleet-patch-audit.md.tmp.3598161.7f4127512795",
-    "runbooks/add-peertube-channel.md.tmp.767109.d14b6e68779c",
+    "projects/fleet-patch-audit.md.tmp.3598161.9e2c0bd025ae",
-    "runbooks/add-peertube-channel.md.tmp.767109.366b5b6ebfe2",
+    "projects/fleet-patch-audit.md.tmp.3598161.dc24c4c7df8b",
-    "runbooks/peertube-remote-runner.md.tmp.767109.9cf753daf1b2",
+    "projects/fleet-patch-audit.md.tmp.3598161.17f66ff46df8",
-    "runbooks/peertube-remote-runner.md.tmp.767109.f739384d8248",
+    "docs/services/services.md.tmp.3598161.5e23f3a83462",
-    "runbooks/peertube-remote-runner.md.tmp.767109.76833270c7a0",
+    "docs/services/services.md.tmp.3598161.69bdec3ce793",
-    "docs/hardware/environment.md.tmp.767109.4e9ed4494a50",
+    "glossary.md.tmp.3598161.3053e87ea7b8",
-    "docs/hardware/environment.md.tmp.767109.3462012af99e",
+    "glossary.md.tmp.3598161.9356baf31ea3",
-    "docs/hardware/environment.md.tmp.767109.55addc2a6c2b",
+    "docs/hardware/ip-allocation.md.tmp.3598161.c2f90b7c0140",
    "runbooks/conduit-operations.md",
    "docs/software/conduit.md",
    "archive/projects/vaultwarden-plan.md",
--- a/vault/docs/hardware/environment.md
+++ b/vault/docs/hardware/environment.md
@ -10,7 +10,7 @@ related:
  - [[headscale-onboard-node]]
  - [[proxmox-create-ubuntu-vm]]
  - [[toc-cortex-pve9.2-update]]
-updated: 2026-07-16
+updated: 2026-07-17
 ---
 # Echo6 Environment Reference
@ -113,7 +113,7 @@ Five nodes running Proxmox VE:
 | ha | 192.168.1.151 | 100.64.0.16 | Home Assistant (VM 151 on cloud, Docker, home automation) |
 | **edge1** (rebuilt Contabo VPS) | 5.189.158.149 | 100.64.0.40 | Debian 12 + Proxmox 8.4.19, **mail-only** — Mailcow in CT 101; host [[caddy]] + mailcow-dnat.service; rebuilt [[2026-06-19]] |
-| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh |
+| edge2 | 184.174.35.153 | 100.64.0.26 | Contabo Cloud VPS 30 NVMe — Proxmox VE 8.4.19 (LXC-only), 8c/24GB/400GB — **permanent front door** for vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com |
 *Last updated: [[2026-06-19]] — Contabo VPS rebuilt as edge1 (mail-only, Debian 12 + Proxmox 8.4.19, 5.189.158.149 / tailnet 100.64.0.40); Mailcow CT 101 (10.10.10.2) on edge1; edge2 is now the permanent front door for all other services; Headscale node `contabo` moved to 100.64.0.40; previously added edge2 CT 107 (headscale), CT 106 (matrix), CT 105 ([[authentik]]), CT 104 (livesync), CT 103 (forgejo), CT 102 (vaultwarden)*
@ -136,7 +136,7 @@ Five nodes running Proxmox VE:
 | mcc | media (CT 111) | 192.168.1.111 | 100.64.0.19 | pymc console web app ([[caddy]] + Postfix, /api+/auth+/ws → aida-nebra :8000) |
 | mailcow | edge1 (CT 101) | 10.10.10.2 | — | Mailcow email server (privileged LXC, mail-only host; reached via host DNAT + Caddy) |
 | pdm | edge2 (CT 100) | 10.10.10.10 | 100.64.0.28 | Proxmox Datacenter Manager |
-| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | WordPress for intermountainmesh.com |
+| wordpress | edge2 (CT 101) | 10.10.10.11 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname `wordpress` unchanged; MariaDB purged — flat-file, no DB) |
 | vaultwarden | edge2 (CT 102) | 10.10.10.20 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) |
 | forgejo | edge2 (CT 103) | 10.10.10.21 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16) |
 | livesync | edge2 (CT 104) | 10.10.10.22 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) |
@ -190,7 +190,7 @@ Current registered nodes (25 total):
 | edge2 | 100.64.0.26 | Proxmox/Contabo VPS |
 | gl-a1300 | 100.64.0.29 | Router |
 | bluefin | 100.64.0.30 | Desktop |
-| wordpress | 100.64.0.31 | LXC |
+| wordpress | 100.64.0.31 | LXC (edge2 CT 101 — now runs Grav CMS; hostname unchanged) |
 | meshai | 100.64.0.32 | LXC |
 | vaultwarden | 100.64.0.33 | LXC (edge2 CT 102) |
 | forgejo | 100.64.0.34 | LXC (edge2 CT 103) — node id 46 |
@ -264,4 +264,4 @@ matt-desktop is accessible via local IP (192.168.1.254) or Tailscale (100.64.0.1
 |---------|-----|
 | Home external (public services) | 199.6.36.163 |
 | edge1 (mail-only, rebuilt Contabo VPS) | 5.189.158.149 |
-| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh/intermountainmesh) | 184.174.35.153 |
+| edge2 (front door: vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh.com) | 184.174.35.153 |
--- a/vault/docs/hardware/ip-allocation.md
+++ b/vault/docs/hardware/ip-allocation.md
@ -10,7 +10,7 @@ related:
  - [[environment]]
  - [[glossary]]
  - [[headscale-onboard-node]]
-updated: 2026-07-16
+updated: 2026-07-17
 ---
 # Echo6 Network IP Allocation
@ -71,12 +71,12 @@ edge1 (rebuilt Contabo VPS, 5.189.158.149 / Tailscale 100.64.0.40) runs Debian 1
 ### edge2 LXC Containers (10.10.10.x, vmbr0) — permanent front door (184.174.35.153)
-edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh/intermountainmesh.
+edge2 (Contabo Cloud VPS 184.174.35.153 / Tailscale 100.64.0.26) uses a separate 10.10.10.0/24 subnet on vmbr0 (gw 10.10.10.1). No DHCP — all IPs are static. Storage: `local` (dir, no local-lvm). **Front door for:** vault/forge/notes/auth/matrix/element/vpn/proxmox.echo6.co + idahomesh.com.
 | IP | Container | CTID | Tailscale | Purpose |
 |----|-----------|------|-----------|---------|
 | 10.10.10.10 | pdm | CT 100 | 100.64.0.28 | Proxmox Datacenter Manager |
-| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | WordPress for intermountainmesh.com |
+| 10.10.10.11 | wordpress | CT 101 | 100.64.0.31 | Grav CMS 2.0.11 for idahomesh.com (migrated from WordPress 2026-07-17; hostname unchanged; MariaDB purged — no DB) |
 | 10.10.10.20 | vaultwarden | CT 102 | 100.64.0.33 | Vaultwarden password manager (migrated from Contabo 2026-06-16) |
 | 10.10.10.21 | forgejo | CT 103 | 100.64.0.34 | Forgejo git server (migrated from Contabo 2026-06-16); git SSH → edge2 forgejo-ssh-dnat.service |
 | 10.10.10.22 | livesync | CT 104 | 100.64.0.35 | LiveSync Obsidian sync (CouchDB + provisioner; migrated from Contabo 2026-06-16) |
--- a/vault/docs/services/services.md
+++ b/vault/docs/services/services.md
@ -10,7 +10,7 @@ related:
  - [[lxc-service-migration]]
  - [[meshtastic-headscale-runbook]]
  - [[expose-service-edge2]]
-updated: 2026-07-13
+updated: 2026-07-17
 ---
 # Current Services Inventory
@ -39,6 +39,7 @@ updated: 2026-07-13
 | Headplane | edge2 (CT 107) | 100.64.0.38:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via [[authentik]]) — fronted by edge2 host Caddy — **migrated from Contabo 2026-06-19** |
 | Mailcow | **edge1 CT 101** (10.10.10.2) | 5.189.158.149 | https://mail.echo6.co | Email server (privileged LXC on rebuilt Contabo VPS, updated commit 52a41b4d / SOGo 5.12.8) — **rebuilt in-place 2026-06-19** |
 | Vaultwarden | edge2 (CT 102) | 100.64.0.33:8086 | https://vault.echo6.co | Password manager (SSO enabled) — fronted by edge2 host Caddy (reverse_proxy 100.64.0.33:8086) |
 | Grav | edge2 (CT 101) | 10.10.10.11:80 | https://idahomesh.com (+www) | Flat-file CMS 2.0.11, no database — Admin2 plugin at /admin; Apache 2.4.67 + mod_php + PHP 8.4.21; migrated from WordPress 2026-07-17 (MariaDB purged from the container); hostname still `wordpress` (unchanged) — fronted by edge2 host Caddy via **internal bridge IP** (reverse_proxy 10.10.10.11:80), unlike other edge2 services which proxy over tailnet |
 | Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ (Syncthing on Contabo decommissioned 2026-06-19 with edge1 rebuild) |
 | Proxmox VE | data node | 192.168.1.240:8006 | https://proxmox.echo6.co | Cluster web UI (via Caddy+Tailscale) |
 | Immich | cloud (CT 120) | 192.168.1.182:2283 | https://immich.echo6.co | Photo management (Docker, NFS storage on pi-nas) |
--- a/vault/glossary.md
+++ b/vault/glossary.md
@ -10,7 +10,7 @@ related:
  - [[caddy]]
  - [[edge2-access-reference]]
  - [[proxmox-onboard-node]]
-updated: 2026-07-13
+updated: 2026-07-17
 ---
 # Glossary & Vocabulary
@ -68,7 +68,7 @@ mesh · matrix · [[recon]] · media · auth · [[dns]] · vpn · storage · pro
 - **pdm** — aliases: 10.10.10.10, CT 100, 100.64.0.28 — on: edge2
 - **[[searxng]]** — aliases: 192.168.1.102, CT 102, 100.64.0.15 — on: utility
 - **vaultwarden** — aliases: 10.10.10.20, CT 102, 100.64.0.33 — on: edge2
- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2
+- **wordpress** — aliases: 10.10.10.11, CT 101, 100.64.0.31 — on: edge2 (hostname unchanged; runs Grav CMS since 2026-07-17, not WordPress — MariaDB removed)
 ### Raspberry Pi / Edge nodes
--- a/vault/projects/fleet-patch-audit.md
+++ b/vault/projects/fleet-patch-audit.md
@ -10,7 +10,7 @@ related:
  - [[caddy]]
  - [[services]]
  - [[ip-allocation]]
-updated: 2026-07-13
+updated: 2026-07-17
 status: complete
 ---
@ -18,7 +18,7 @@ status: complete
 Read-only audit snapshot as of 2026-06-19. **Nothing has been applied — this is a planning document to build the patch plan from.**
-**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149).
+**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149). **CT101 update (2026-07-17):** migrated from WordPress/MariaDB to **Grav CMS 2.0.11** (flat-file, no database — MariaDB purged from the container); serves idahomesh.com (not intermountainmesh.com — that domain has always been parked at a third party and never reached this container); hostname `wordpress` unchanged. See [[environment]] / [[services]] for current state. All WordPress/MariaDB references below reflect the pre-migration state as audited on 2026-06-19 and are left as historical record.
 ---
@ -143,7 +143,7 @@ Running application version vs latest stable upstream, per app — the "is every
 ### Current / already past the fix (no action)
-Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
+Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101 — **superseded 2026-07-17, see topology note above**) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
 ### Lower urgency
@ -747,7 +747,7 @@ Complete point-in-time state of every node, guest, and container service.
 | CT | Name | Services / Status |
 |----|------|-------------------|
 | CT100 | pdm | PDM 1.1.4, current (native) |
-| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI |
+| CT101 | wordpress | Apache 2.4.67 / PHP 8.4 / MariaDB 11.8.6 / WP core 7.0 — plugin/theme status needs WP-CLI (**superseded 2026-07-17 — migrated to Grav CMS, MariaDB removed; see topology note above**) |
 | CT102 | vaultwarden | vaultwarden/server:latest — drift indeterminate |
 | CT103 | forgejo | 14.0.5 (forgejo:14 + postgres:16-alpine drifted) |
 | CT104 | livesync | couchdb:3.4 drifted + local provisioner |
@ -762,5 +762,5 @@ Complete point-in-time state of every node, guest, and container service.
 - **Complete:** all five PVE-9 nodes (data, utility, cloud, media, toc), edge2, cortex, pi-nas, and all discovered guests/containers.
 - **Excluded:** edge1 (the rebuilt ex-Contabo, mail-only) — mid-rebuild/maintenance at time of audit; re-audit once it settles.
- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed.
+- **Incomplete:** WordPress (CT101) plugin and theme status — requires WP-CLI; not assessed. (Moot as of 2026-07-17 — CT101 migrated to Grav CMS, no plugins/DB; see topology note above.)
 - **Method:** read-only throughout — SSH / `pct exec`, `apt list --upgradable`, `docker manifest inspect` for same-tag drift. Floating/pinned-tag caveats noted inline where drift could not be confirmed.