auto: docs sync 2026-06-18T12:00:08+00:00
Files changed: .gitignore engine/.embcache.json engine/changelog.md engine/lib/__pycache__/__init__.cpython-312.pyc engine/lib/__pycache__/agent.cpython-312.pyc engine/lib/agent.py engine/lint-report.md engine/prompts/system.md engine/sweep.sh vault/.obsidian/graph.json vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/recon.md vault/notes/echo6-landing-page-data-export.md vault/projects/argus.md vault/projects/meshtastic-headscale-runbook.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/ct-runbook.md vault/runbooks/meshtastic-sidecar-node.md
This commit is contained in:
echo6-autocommit
parent
1d30335963
commit
c30ce9f1e3
20 changed files with 1490 additions and 703 deletions
|
|
@ -1,310 +1,326 @@
|
|||
# ARGUS - OSINT Intelligence Platform
|
||||
|
||||
**Status:** Container provisioned, baseline installed, awaiting application deployment
|
||||
**Last Updated:** 2026-06-14
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) is an OSINT intelligence gathering platform combining SearXNG with local LLM analysis for automated threat intelligence collection and processing.
|
||||
|
||||
**Architecture:**
|
||||
- Search backend: SearXNG (self-hosted)
|
||||
- Analysis: Local LLM models (no cloud APIs)
|
||||
- Scopes: Local, regional, national, global threat levels
|
||||
- Privacy-first: No PII collection, focus on events/trends/policies
|
||||
|
||||
---
|
||||
|
||||
## Container Specifications
|
||||
|
||||
| Property | Value |
|
||||
|----------|-------|
|
||||
| **CTID** | 103 |
|
||||
| **Hostname** | argus |
|
||||
| **Host** | utility (192.168.1.241 / 100.64.0.5) |
|
||||
| **Local IP** | 192.168.1.103 (static) |
|
||||
| **Tailscale IP** | 100.64.0.25 |
|
||||
| **Gateway** | 192.168.1.1 |
|
||||
| **Container Type** | Privileged (unprivileged=0) |
|
||||
| **Resources** | 4 cores, 8GB RAM, 30GB disk |
|
||||
| **Storage** | local-lvm:vm-103-disk-0 |
|
||||
| **Network** | vmbr0, eth0 |
|
||||
| **Features** | nesting=1 (Docker support) |
|
||||
| **Autostart** | Yes (onboot=1) |
|
||||
| **OS** | Ubuntu 24.04 LTS |
|
||||
|
||||
**Why privileged:** Required for /dev/net/tun access (Tailscale). Attempted unprivileged initially but tailscaled failed with "CreateTUN failed; /dev/net/tun does not exist".
|
||||
|
||||
---
|
||||
|
||||
## Installed Software (Baseline)
|
||||
|
||||
- **Docker:** 29.5.3 + docker-compose plugin
|
||||
- **Tailscale:** 1.98.4 (registered with Headscale at vpn.echo6.co)
|
||||
- **User:** zvx (uid=1000, groups: sudo, docker)
|
||||
- **Common tools:** curl, wget, vim, htop, git, jq, net-tools, dnsutils, sshpass
|
||||
- **SSH:** OpenSSH server (password auth enabled)
|
||||
|
||||
---
|
||||
|
||||
## Tailscale Configuration
|
||||
|
||||
**Headscale server:** https://vpn.echo6.co
|
||||
**User:** echo6 (user ID 1)
|
||||
**Tailscale IP:** 100.64.0.25
|
||||
**Registration:** `tailscale up --login-server=https://vpn.echo6.co --authkey=<key> --ssh --accept-routes`
|
||||
|
||||
**DNS Bootstrap Fix:**
|
||||
Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback DNS (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg DNS resolution failures on reboot.
|
||||
|
||||
```bash
|
||||
[Service]
|
||||
# Ensure fallback DNS exists before tailscaled starts
|
||||
# Prevents chicken-and-egg DNS resolution failures on reboot
|
||||
ExecStartPre=/bin/sh -c "echo nameserver 1.1.1.1 > /etc/resolv.conf; echo nameserver 8.8.8.8 >> /etc/resolv.conf"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Network Configuration
|
||||
|
||||
**Static IP:** Configured via Proxmox (`pct set 103 -net0 name=eth0,bridge=vmbr0,ip=192.168.1.103/24,gw=192.168.1.1`)
|
||||
|
||||
**Container config** (`/etc/pve/lxc/103.conf`):
|
||||
```
|
||||
arch: amd64
|
||||
cores: 4
|
||||
features: nesting=1
|
||||
hostname: argus
|
||||
memory: 8192
|
||||
net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:EA:8B:21,ip=192.168.1.103/24,gw=192.168.1.1,type=veth
|
||||
onboot: 1
|
||||
ostype: ubuntu
|
||||
rootfs: local-lvm:vm-103-disk-0,size=30G
|
||||
swap: 512
|
||||
lxc.cgroup2.devices.allow: c 10:200 rwm
|
||||
lxc.mount.entry: /dev/net dev/net none bind,create=dir
|
||||
```
|
||||
|
||||
**TUN device:** Added manually via `lxc.cgroup2.devices.allow` and `lxc.mount.entry` to support Tailscale in privileged container.
|
||||
|
||||
---
|
||||
|
||||
## Access Methods
|
||||
|
||||
### SSH Access
|
||||
|
||||
```bash
|
||||
# Local network (static IP)
|
||||
ssh zvx@192.168.1.103
|
||||
|
||||
# Tailscale VPN
|
||||
ssh zvx@100.64.0.25
|
||||
ssh zvx@argus
|
||||
|
||||
# With password (for sshpass workflows)
|
||||
sshpass -p '7redditGold' ssh zvx@192.168.1.103
|
||||
```
|
||||
|
||||
**Credentials:**
|
||||
- User: `zvx`
|
||||
- Password: `7redditGold`
|
||||
- Sudo: Enabled (no password prompt)
|
||||
|
||||
### From Proxmox Host
|
||||
|
||||
```bash
|
||||
# Execute commands in container
|
||||
pct exec 103 -- <command>
|
||||
|
||||
# Enter container shell
|
||||
pct enter 103
|
||||
|
||||
# Container management
|
||||
pct start 103
|
||||
pct stop 103
|
||||
pct reboot 103
|
||||
pct status 103
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ARGUS Application Architecture (Planned)
|
||||
|
||||
### Geographic Scope Hierarchy
|
||||
|
||||
| Scope | Description | Update Frequency |
|
||||
|-------|-------------|------------------|
|
||||
| LOCAL | Idaho, immediate region | High |
|
||||
| REGIONAL | Pacific Northwest, neighboring states | Medium |
|
||||
| NATIONAL | US-wide threats, policy changes | Medium |
|
||||
| GLOBAL | International, geopolitical | Low |
|
||||
|
||||
### Data Storage
|
||||
|
||||
- **Raw search results:** `data/raw/{scope}/{date}/`
|
||||
- **Processed intel:** `data/processed/{scope}/`
|
||||
- **Alerts:** `data/alerts/`
|
||||
- **Timestamps:** All in UTC
|
||||
|
||||
### Privacy Rules
|
||||
|
||||
- No PII collection on individuals
|
||||
- Focus on events, trends, policies — not people
|
||||
- Scrub any inadvertent PII before storage
|
||||
- Logs must not contain search queries with personal info
|
||||
|
||||
### LLM Analysis
|
||||
|
||||
- **Model hosting:** Local only (no cloud APIs)
|
||||
- **Functions:** Summarization, threat classification, entity extraction, sentiment/threat scoring
|
||||
- **Entities:** Locations, organizations (not individuals)
|
||||
|
||||
---
|
||||
|
||||
## Provisioning History
|
||||
|
||||
**2026-06-14 03:00 UTC** - Initial provisioning
|
||||
|
||||
1. **First attempt (unprivileged):** Failed - tailscaled couldn't access /dev/net/tun
|
||||
2. **Second attempt (privileged):** Success
|
||||
- Created CT 103 with `--unprivileged 0`
|
||||
- Installed baseline (apt update/upgrade, common tools, Docker, Tailscale)
|
||||
- DNS fix required post-restart (resolv.conf reset to 100.100.100.100)
|
||||
- Added DNS bootstrap systemd drop-in to prevent future DNS failures
|
||||
- Configured static IP 192.168.1.103 (originally got .142 via DHCP)
|
||||
- Added TUN device support via lxc.cgroup2 and lxc.mount.entry
|
||||
|
||||
**Headscale registration:**
|
||||
- Created preauth key via `docker exec headscale headscale preauthkeys create --user 1 --expiration 24h --reusable`
|
||||
- Registered successfully after DNS fix
|
||||
- Assigned Tailscale IP: 100.64.0.25
|
||||
|
||||
---
|
||||
|
||||
## Verification Checklist
|
||||
|
||||
Run inside container to verify baseline:
|
||||
|
||||
```bash
|
||||
pct exec 103 -- bash -c '
|
||||
echo "=== CT Provisioning Check ==="
|
||||
echo ""
|
||||
echo "Hostname: $(hostname)"
|
||||
echo "User zvx: $(id zvx 2>/dev/null && echo OK || echo MISSING)"
|
||||
echo "sudo: $(sudo -l -U zvx 2>/dev/null | grep -q ALL && echo OK || echo MISSING)"
|
||||
echo "sshpass: $(which sshpass >/dev/null 2>&1 && echo OK || echo MISSING)"
|
||||
echo "SSH: $(systemctl is-active ssh)"
|
||||
echo "Docker: $(docker --version 2>/dev/null || echo MISSING)"
|
||||
echo "Tailscale: $(tailscale status --self 2>/dev/null | head -1 || echo NOT CONNECTED)"
|
||||
echo "Tailscale IP: $(tailscale ip -4 2>/dev/null || echo N/A)"
|
||||
echo "Local IP: $(hostname -I | awk \"{print \$1}\")"
|
||||
'
|
||||
```
|
||||
|
||||
**Expected output:**
|
||||
```
|
||||
=== CT Provisioning Check ===
|
||||
|
||||
Hostname: argus
|
||||
User zvx: uid=1000(zvx) gid=1000(zvx) groups=1000(zvx),27(sudo),990(docker) OK
|
||||
sudo: OK
|
||||
sshpass: OK
|
||||
SSH: active
|
||||
Docker: Docker version 29.5.3, build d1c06ef
|
||||
Tailscale: 100.64.0.25 argus echo6 linux -
|
||||
Tailscale IP: 100.64.0.25
|
||||
Local IP: 192.168.1.103
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Known Issues & Resolutions
|
||||
|
||||
### Issue: DNS resolution fails after container restart
|
||||
|
||||
**Symptom:** `resolv.conf` gets reset to invalid nameserver (100.100.100.100), breaking apt and network connectivity.
|
||||
|
||||
**Root cause:** LXC containers sometimes reset DNS on boot before networking is fully initialized.
|
||||
|
||||
**Resolution:** Installed systemd drop-in (`/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf`) that sets fallback DNS before tailscaled starts. Prevents chicken-and-egg failure where Tailscale can't resolve vpn.echo6.co because DNS is broken.
|
||||
|
||||
### Issue: Tailscaled fails with "/dev/net/tun does not exist"
|
||||
|
||||
**Symptom:** Tailscaled crashes on startup with `CreateTUN("tailscale0") failed; /dev/net/tun does not exist`.
|
||||
|
||||
**Root cause:** Unprivileged LXC containers don't have access to /dev/net/tun by default.
|
||||
|
||||
**Resolution:** Recreated container as privileged (`--unprivileged 0`) and added TUN device to container config:
|
||||
```
|
||||
lxc.cgroup2.devices.allow: c 10:200 rwm
|
||||
lxc.mount.entry: /dev/net dev/net none bind,create=dir
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Next Steps (Application Deployment)
|
||||
|
||||
1. **SearXNG deployment:** Docker container for self-hosted search aggregation
|
||||
2. **LLM integration:** Local model for analysis (Ollama on cortex or self-hosted)
|
||||
3. **Database:** SQLite for processed intel, possibly Qdrant for vector search (cortex:6333 available)
|
||||
4. **Scheduler:** Cron or systemd timers for automated collection
|
||||
5. **Web dashboard:** Flask/FastAPI for threat intel visualization
|
||||
6. **Alerting:** Integration with Matrix/email for high-priority threats
|
||||
|
||||
---
|
||||
|
||||
## Operational Notes
|
||||
|
||||
- **Backup strategy:** TBD (Docker volumes + application data)
|
||||
- **Log rotation:** TBD
|
||||
- **Monitoring:** TBD (consider adding to WATCHTOWER ops dashboard)
|
||||
- **Updates:** Standard Ubuntu + Docker update procedures
|
||||
- **Resource scaling:** Can adjust cores/RAM via `pct set 103 -cores X -memory Y` (requires container restart)
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **CT provisioning:** `/home/zvx/projects/.ref/runbooks/ct-runbook.md`
|
||||
- **ARGUS rules:** `~/.claude/rules/argus.md`
|
||||
- **Environment:** `/home/zvx/projects/.ref/docs/hardware/environment.md`
|
||||
- **Services:** `/home/zvx/projects/.ref/docs/services/services.md`
|
||||
- **Headscale:** `/home/zvx/projects/.ref/docs/software/caddy.md` (dnsmasq split DNS)
|
||||
|
||||
---
|
||||
|
||||
## Quick Command Reference
|
||||
|
||||
```bash
|
||||
# Container management (from Proxmox host)
|
||||
pct start 103
|
||||
pct stop 103
|
||||
pct reboot 103
|
||||
pct enter 103
|
||||
|
||||
# SSH access
|
||||
ssh zvx@192.168.1.103
|
||||
ssh zvx@argus # via Tailscale DNS
|
||||
|
||||
# Check Tailscale status
|
||||
pct exec 103 -- tailscale status
|
||||
pct exec 103 -- tailscale ip -4
|
||||
|
||||
# Docker commands (as zvx user)
|
||||
ssh zvx@argus "docker ps"
|
||||
ssh zvx@argus "docker compose up -d"
|
||||
|
||||
# View container config
|
||||
cat /etc/pve/lxc/103.conf
|
||||
|
||||
# Check resource usage
|
||||
pct status 103 --verbose
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Provisioned by:** Claude Code
|
||||
**Container ready for:** ARGUS application deployment
|
||||
---
|
||||
title: ARGUS - OSINT Intelligence Platform
|
||||
type: project
|
||||
tags:
|
||||
- mesh
|
||||
- auth
|
||||
- recon
|
||||
aliases: []
|
||||
related:
|
||||
- [[ip-allocation]]
|
||||
- [[caddy]]
|
||||
- [[headscale-onboard-node]]
|
||||
- [[ct-runbook]]
|
||||
- [[environment]]
|
||||
updated: 2026-06-18
|
||||
---
|
||||
# ARGUS - OSINT Intelligence Platform
|
||||
|
||||
**Status:** Container provisioned, baseline installed, awaiting application deployment
|
||||
**Last Updated:** 2026-06-14
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) is an OSINT intelligence gathering platform combining SearXNG with local LLM analysis for automated threat intelligence collection and processing.
|
||||
|
||||
**Architecture:**
|
||||
- Search backend: SearXNG (self-hosted)
|
||||
- Analysis: Local LLM models (no cloud APIs)
|
||||
- Scopes: Local, regional, national, global threat levels
|
||||
- Privacy-first: No PII collection, focus on events/trends/policies
|
||||
|
||||
---
|
||||
|
||||
## Container Specifications
|
||||
|
||||
| Property | Value |
|
||||
|----------|-------|
|
||||
| **CTID** | 103 |
|
||||
| **Hostname** | argus |
|
||||
| **Host** | utility (192.168.1.241 / 100.64.0.5) |
|
||||
| **Local IP** | 192.168.1.103 (static) |
|
||||
| **Tailscale IP** | 100.64.0.25 |
|
||||
| **Gateway** | 192.168.1.1 |
|
||||
| **Container Type** | Privileged (unprivileged=0) |
|
||||
| **Resources** | 4 cores, 8GB RAM, 30GB disk |
|
||||
| **Storage** | local-lvm:vm-103-disk-0 |
|
||||
| **Network** | vmbr0, eth0 |
|
||||
| **Features** | nesting=1 (Docker support) |
|
||||
| **Autostart** | Yes (onboot=1) |
|
||||
| **OS** | Ubuntu 24.04 LTS |
|
||||
|
||||
**Why privileged:** Required for /dev/net/tun access (Tailscale). Attempted unprivileged initially but tailscaled failed with "CreateTUN failed; /dev/net/tun does not exist".
|
||||
|
||||
---
|
||||
|
||||
## Installed Software (Baseline)
|
||||
|
||||
- **Docker:** 29.5.3 + docker-compose plugin
|
||||
- **Tailscale:** 1.98.4 (registered with Headscale at vpn.echo6.co)
|
||||
- **User:** zvx (uid=1000, groups: sudo, docker)
|
||||
- **Common tools:** curl, wget, vim, htop, git, jq, net-tools, dnsutils, sshpass
|
||||
- **SSH:** OpenSSH server (password auth enabled)
|
||||
|
||||
---
|
||||
|
||||
## Tailscale Configuration
|
||||
|
||||
**Headscale server:** https://vpn.echo6.co
|
||||
**User:** echo6 (user ID 1)
|
||||
**Tailscale IP:** 100.64.0.25
|
||||
**Registration:** `tailscale up --login-server=https://vpn.echo6.co --authkey=<key> --ssh --accept-routes`
|
||||
|
||||
**DNS Bootstrap Fix:**
|
||||
Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback DNS (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg DNS resolution failures on reboot.
|
||||
|
||||
```bash
|
||||
[Service]
|
||||
# Ensure fallback DNS exists before tailscaled starts
|
||||
# Prevents chicken-and-egg DNS resolution failures on reboot
|
||||
ExecStartPre=/bin/sh -c "echo nameserver 1.1.1.1 > /etc/resolv.conf; echo nameserver 8.8.8.8 >> /etc/resolv.conf"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Network Configuration
|
||||
|
||||
**Static IP:** Configured via Proxmox (`pct set 103 -net0 name=eth0,bridge=vmbr0,ip=192.168.1.103/24,gw=192.168.1.1`)
|
||||
|
||||
**Container config** (`/etc/pve/lxc/103.conf`):
|
||||
```
|
||||
arch: amd64
|
||||
cores: 4
|
||||
features: nesting=1
|
||||
hostname: argus
|
||||
memory: 8192
|
||||
net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:EA:8B:21,ip=192.168.1.103/24,gw=192.168.1.1,type=veth
|
||||
onboot: 1
|
||||
ostype: ubuntu
|
||||
rootfs: local-lvm:vm-103-disk-0,size=30G
|
||||
swap: 512
|
||||
lxc.cgroup2.devices.allow: c 10:200 rwm
|
||||
lxc.mount.entry: /dev/net dev/net none bind,create=dir
|
||||
```
|
||||
|
||||
**TUN device:** Added manually via `lxc.cgroup2.devices.allow` and `lxc.mount.entry` to support Tailscale in privileged container.
|
||||
|
||||
---
|
||||
|
||||
## Access Methods
|
||||
|
||||
### SSH Access
|
||||
|
||||
```bash
|
||||
# Local network (static IP)
|
||||
ssh zvx@192.168.1.103
|
||||
|
||||
# Tailscale VPN
|
||||
ssh zvx@100.64.0.25
|
||||
ssh zvx@argus
|
||||
|
||||
# With password (for sshpass workflows)
|
||||
sshpass -p '7redditGold' ssh zvx@192.168.1.103
|
||||
```
|
||||
|
||||
**Credentials:**
|
||||
- User: `zvx`
|
||||
- Password: `7redditGold`
|
||||
- Sudo: Enabled (no password prompt)
|
||||
|
||||
### From Proxmox Host
|
||||
|
||||
```bash
|
||||
# Execute commands in container
|
||||
pct exec 103 -- <command>
|
||||
|
||||
# Enter container shell
|
||||
pct enter 103
|
||||
|
||||
# Container management
|
||||
pct start 103
|
||||
pct stop 103
|
||||
pct reboot 103
|
||||
pct status 103
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ARGUS Application Architecture (Planned)
|
||||
|
||||
### Geographic Scope Hierarchy
|
||||
|
||||
| Scope | Description | Update Frequency |
|
||||
|-------|-------------|------------------|
|
||||
| LOCAL | Idaho, immediate region | High |
|
||||
| REGIONAL | Pacific Northwest, neighboring states | Medium |
|
||||
| NATIONAL | US-wide threats, policy changes | Medium |
|
||||
| GLOBAL | International, geopolitical | Low |
|
||||
|
||||
### Data Storage
|
||||
|
||||
- **Raw search results:** `data/raw/{scope}/{date}/`
|
||||
- **Processed intel:** `data/processed/{scope}/`
|
||||
- **Alerts:** `data/alerts/`
|
||||
- **Timestamps:** All in UTC
|
||||
|
||||
### Privacy Rules
|
||||
|
||||
- No PII collection on individuals
|
||||
- Focus on events, trends, policies — not people
|
||||
- Scrub any inadvertent PII before storage
|
||||
- Logs must not contain search queries with personal info
|
||||
|
||||
### LLM Analysis
|
||||
|
||||
- **Model hosting:** Local only (no cloud APIs)
|
||||
- **Functions:** Summarization, threat classification, entity extraction, sentiment/threat scoring
|
||||
- **Entities:** Locations, organizations (not individuals)
|
||||
|
||||
---
|
||||
|
||||
## Provisioning History
|
||||
|
||||
**2026-06-14 03:00 UTC** - Initial provisioning
|
||||
|
||||
1. **First attempt (unprivileged):** Failed - tailscaled couldn't access /dev/net/tun
|
||||
2. **Second attempt (privileged):** Success
|
||||
- Created CT 103 with `--unprivileged 0`
|
||||
- Installed baseline (apt update/upgrade, common tools, Docker, Tailscale)
|
||||
- DNS fix required post-restart (resolv.conf reset to 100.100.100.100)
|
||||
- Added DNS bootstrap systemd drop-in to prevent future DNS failures
|
||||
- Configured static IP 192.168.1.103 (originally got .142 via DHCP)
|
||||
- Added TUN device support via lxc.cgroup2 and lxc.mount.entry
|
||||
|
||||
**Headscale registration:**
|
||||
- Created preauth key via `docker exec headscale headscale preauthkeys create --user 1 --expiration 24h --reusable`
|
||||
- Registered successfully after DNS fix
|
||||
- Assigned Tailscale IP: 100.64.0.25
|
||||
|
||||
---
|
||||
|
||||
## Verification Checklist
|
||||
|
||||
Run inside container to verify baseline:
|
||||
|
||||
```bash
|
||||
pct exec 103 -- bash -c '
|
||||
echo "=== CT Provisioning Check ==="
|
||||
echo ""
|
||||
echo "Hostname: $(hostname)"
|
||||
echo "User zvx: $(id zvx 2>/dev/null && echo OK || echo MISSING)"
|
||||
echo "sudo: $(sudo -l -U zvx 2>/dev/null | grep -q ALL && echo OK || echo MISSING)"
|
||||
echo "sshpass: $(which sshpass >/dev/null 2>&1 && echo OK || echo MISSING)"
|
||||
echo "SSH: $(systemctl is-active ssh)"
|
||||
echo "Docker: $(docker --version 2>/dev/null || echo MISSING)"
|
||||
echo "Tailscale: $(tailscale status --self 2>/dev/null | head -1 || echo NOT CONNECTED)"
|
||||
echo "Tailscale IP: $(tailscale ip -4 2>/dev/null || echo N/A)"
|
||||
echo "Local IP: $(hostname -I | awk \"{print \$1}\")"
|
||||
'
|
||||
```
|
||||
|
||||
**Expected output:**
|
||||
```
|
||||
=== CT Provisioning Check ===
|
||||
|
||||
Hostname: argus
|
||||
User zvx: uid=1000(zvx) gid=1000(zvx) groups=1000(zvx),27(sudo),990(docker) OK
|
||||
sudo: OK
|
||||
sshpass: OK
|
||||
SSH: active
|
||||
Docker: Docker version 29.5.3, build d1c06ef
|
||||
Tailscale: 100.64.0.25 argus echo6 linux -
|
||||
Tailscale IP: 100.64.0.25
|
||||
Local IP: 192.168.1.103
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Known Issues & Resolutions
|
||||
|
||||
### Issue: DNS resolution fails after container restart
|
||||
|
||||
**Symptom:** `resolv.conf` gets reset to invalid nameserver (100.100.100.100), breaking apt and network connectivity.
|
||||
|
||||
**Root cause:** LXC containers sometimes reset DNS on boot before networking is fully initialized.
|
||||
|
||||
**Resolution:** Installed systemd drop-in (`/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf`) that sets fallback DNS before tailscaled starts. Prevents chicken-and-egg failure where Tailscale can't resolve vpn.echo6.co because DNS is broken.
|
||||
|
||||
### Issue: Tailscaled fails with "/dev/net/tun does not exist"
|
||||
|
||||
**Symptom:** Tailscaled crashes on startup with `CreateTUN("tailscale0") failed; /dev/net/tun does not exist`.
|
||||
|
||||
**Root cause:** Unprivileged LXC containers don't have access to /dev/net/tun by default.
|
||||
|
||||
**Resolution:** Recreated container as privileged (`--unprivileged 0`) and added TUN device to container config:
|
||||
```
|
||||
lxc.cgroup2.devices.allow: c 10:200 rwm
|
||||
lxc.mount.entry: /dev/net dev/net none bind,create=dir
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Next Steps (Application Deployment)
|
||||
|
||||
1. **SearXNG deployment:** Docker container for self-hosted search aggregation
|
||||
2. **LLM integration:** Local model for analysis (Ollama on cortex or self-hosted)
|
||||
3. **Database:** SQLite for processed intel, possibly Qdrant for vector search (cortex:6333 available)
|
||||
4. **Scheduler:** Cron or systemd timers for automated collection
|
||||
5. **Web dashboard:** Flask/FastAPI for threat intel visualization
|
||||
6. **Alerting:** Integration with Matrix/email for high-priority threats
|
||||
|
||||
---
|
||||
|
||||
## Operational Notes
|
||||
|
||||
- **Backup strategy:** TBD (Docker volumes + application data)
|
||||
- **Log rotation:** TBD
|
||||
- **Monitoring:** TBD (consider adding to WATCHTOWER ops dashboard)
|
||||
- **Updates:** Standard Ubuntu + Docker update procedures
|
||||
- **Resource scaling:** Can adjust cores/RAM via `pct set 103 -cores X -memory Y` (requires container restart)
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **CT provisioning:** `/home/zvx/projects/.ref/runbooks/ct-runbook.md`
|
||||
- **ARGUS rules:** `~/.claude/rules/argus.md`
|
||||
- **Environment:** `/home/zvx/projects/.ref/docs/hardware/environment.md`
|
||||
- **Services:** `/home/zvx/projects/.ref/docs/services/services.md`
|
||||
- **Headscale:** `/home/zvx/projects/.ref/docs/software/caddy.md` (dnsmasq split DNS)
|
||||
|
||||
---
|
||||
|
||||
## Quick Command Reference
|
||||
|
||||
```bash
|
||||
# Container management (from Proxmox host)
|
||||
pct start 103
|
||||
pct stop 103
|
||||
pct reboot 103
|
||||
pct enter 103
|
||||
|
||||
# SSH access
|
||||
ssh zvx@192.168.1.103
|
||||
ssh zvx@argus # via Tailscale DNS
|
||||
|
||||
# Check Tailscale status
|
||||
pct exec 103 -- tailscale status
|
||||
pct exec 103 -- tailscale ip -4
|
||||
|
||||
# Docker commands (as zvx user)
|
||||
ssh zvx@argus "docker ps"
|
||||
ssh zvx@argus "docker compose up -d"
|
||||
|
||||
# View container config
|
||||
cat /etc/pve/lxc/103.conf
|
||||
|
||||
# Check resource usage
|
||||
pct status 103 --verbose
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Provisioned by:** Claude Code
|
||||
**Container ready for:** ARGUS application deployment
|
||||
|
|
|
|||
|
|
@ -1,3 +1,19 @@
|
|||
---
|
||||
title: IdahoMesh Tailnet Runbook
|
||||
type: project
|
||||
tags:
|
||||
- mesh
|
||||
- vpn
|
||||
- auth
|
||||
aliases: []
|
||||
related:
|
||||
- [[idahomesh-vpn-device-setup]]
|
||||
- [[idahomesh-bridge-setup]]
|
||||
- [[meshtastic-sidecar-node]]
|
||||
- [[headscale-onboard-node]]
|
||||
- [[caddy]]
|
||||
updated: 2026-06-18
|
||||
---
|
||||
# IdahoMesh Tailnet Runbook
|
||||
|
||||
## Overview
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue