matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auto: docs sync 2026-07-12T00:00:23+00:00

Browse source 
Files changed: ", c.get(k))\nPY\n\\\"\n\"" engine/config.yaml engine/lib/lint.py engine/lib/vocab_gen.py engine/lint-report.md engine/sweep.sh vault/.obsidian/workspace.json vault/archive/projects/meshai-native-fire-severity-audit-cc-handoff.md vault/archive/projects/vaultwarden-plan.md vault/docs/matrix/matrix_host.md vault/docs/matrix/synapse.md vault/docs/services/services.md vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/docs/software/recon.md vault/docs/software/searxng.md vault/glossary.md vault/notes/echo6-landing-page-data-export.md vault/projects/matrix-synapse-deployment.md vault/projects/meshai.md vault/projects/meshtastic-headscale-runbook.md vault/projects/mmud-project.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/authentik-create-invitation.md vault/runbooks/authentik-oidc-application.md vault/runbooks/authentik-upgrade.md vault/runbooks/expose-service-contabo.md vault/runbooks/lxc-service-migration.md vault/runbooks/mailcow-create-mailbox.md vault/runbooks/meshtastic-sidecar-node.md vault/runbooks/meshtasticd-sim-nodes-runbook.md vault/runbooks/proxmox-create-ubuntu-vm.md vault/runbooks/recon-operations.md vault/runbooks/recon-service-integration.md vault/runbooks/syncthing-add-node.md
This commit is contained in:
echo6-autocommit 2026-07-12 00:00:23 +00:00
commit cce29c595d
37 changed files with 336 additions and 262 deletions
Download patch file Download diff file Expand all files Collapse all files

17
vault/docs/software/authentik.md
View file

@ -10,13 +10,15 @@ related:
- [[caddy]]
- [[echo6-landing-page-data-export]]
- [[authentik-access-groups]]
updated: 2026-06-18
updated: 2026-07-11
---
# Authentik SSO Configuration
> Migrated off Contabo → edge2 on 2026-06-18.
## Location
- **Server:** Contabo (5.189.158.149 / 100.64.0.1)
- **Server:** edge2 CT 105 (100.64.0.36)
- **URL:** https://auth.echo6.co
- **Internal Port:** 9000
@ -108,7 +110,7 @@ Users must be in at least one bound group to access the application.
## Create New API Token
```bash
ssh root@100.64.0.1 'docker exec -i authentik-server ak shell' <<'PYEOF'
ssh edge2 'sudo pct exec 105 -- docker exec -i authentik-server ak shell' <<'PYEOF'
from authentik.core.models import Token, TokenIntents, User
user = User.objects.get(username="akadmin")
Token.objects.filter(identifier="token-name").delete()
@ -331,11 +333,12 @@ Echo6 cyberpunk branding applied to Authentik 2025.12.4 via System → Brands.
The custom CSS is stored in the Brand model's `branding_custom_css` field. To update:
```bash
# Copy CSS to Contabo
scp /path/to/echo6-authentik.css root@100.64.0.1:/opt/authentik/branding/custom.css
# Copy CSS to edge2 CT 105 (via edge2 host, then pct push into the CT)
scp /path/to/echo6-authentik.css edge2:/tmp/echo6-authentik.css
ssh edge2 'sudo pct push 105 /tmp/echo6-authentik.css /opt/authentik/branding/custom.css'
# Load into Brand model via ak shell
ssh root@100.64.0.1 'docker exec -i authentik-server ak shell' <<'PYEOF'
ssh edge2 'sudo pct exec 105 -- docker exec -i authentik-server ak shell' <<'PYEOF'
from authentik.brands.models import Brand
b = Brand.objects.get(domain="auth.echo6.co")
b.branding_custom_css = open("/media/custom/custom.css").read()
@ -343,7 +346,7 @@ b.save()
PYEOF
# Restart to apply
ssh root@100.64.0.1 'cd /opt/authentik && docker compose restart server worker'
ssh edge2 'sudo pct exec 105 -- bash -c "cd /opt/authentik && docker compose restart server worker"'
```
### SSO Launch URL Pattern

110
vault/docs/software/caddy.md
View file

@ -10,13 +10,15 @@ related:
- [[headscale-onboard-node]]
- [[expose-service-home]]
- [[lxc-service-migration]]
updated: 2026-06-18
updated: 2026-07-11
---
# Caddy & DNS Reference
## Contabo Caddy
> Migrated off Contabo → edge2 on 2026-06-19.
**Config:** `/etc/caddy/Caddyfile` on Contabo (ssh root@100.64.0.1)
## edge2 Caddy (front door)
**Config:** `/etc/caddy/Caddyfile` on edge2 (`ssh edge2`; `root@<IP>` is stale)
**Global options:** `email admin@echo6.co`, `admin off` (no live reload — must `systemctl restart caddy`)
@ -24,25 +26,25 @@ updated: 2026-06-18
| Domain | Backend | Service |
|--------|---------|---------|
| auth.echo6.co | 127.0.0.1:9000 | [[authentik]] SSO |
| forge.echo6.co | 127.0.0.1:3001 | Forgejo Git |
| mail.echo6.co | https://127.0.0.1:8453 | Mailcow (tls_insecure_skip_verify, r/w timeout 3600s) |
| vpn.echo6.co | 127.0.0.1:8084 | Headscale |
| vpn.echo6.co/admin* | 127.0.0.1:3100 | Headplane |
| autodiscover.echo6.co | https://127.0.0.1:8443 | Mailcow autodiscover |
| autoconfig.echo6.co | https://127.0.0.1:8443 | Mailcow autoconfig |
| vault.echo6.co | 127.0.0.1:8086 | vaultwarden |
| proxmox.echo6.co | https://100.64.0.6:8006 (via Tailscale) | Proxmox VE (data node) |
| wt.echo6.co | 127.0.0.1:8099 ([[authentik]] forward auth) | WATCHTOWER ops dashboard |
| matrix.echo6.co | 127.0.0.1:8008 + 127.0.0.1:8085 | Matrix [[synapse]] + MAS (login/logout/refresh/auth_metadata → MAS:8085, _matrix/* → [[synapse]]:8008, default → MAS:8085) |
| element.echo6.co | 127.0.0.1:8088 | Element Web client |
| notes.echo6.co | 127.0.0.1:5984 + 127.0.0.1:5985 | LiveSync (CouchDB + provisioner, forward auth on /_provision*, CORS for Obsidian) |
| tak.echo6.co | https://100.64.0.1:8446 + 100.64.0.1:8990 | TAK Server admin (8446, [[authentik]] forward auth) + SIGIL console (/sigil, 8990) |
| auth.echo6.co | 100.64.0.36:9000 (Tailscale, CT 105) | [[authentik]] SSO |
| forge.echo6.co | 100.64.0.34:3001 (Tailscale, CT 103) | Forgejo Git |
| mail.echo6.co | — | Mailcow — moved to **edge1** (separate mail-only host, 10.10.10.2:8453 via edge1's own Caddy); not on edge2 |
| vpn.echo6.co | 100.64.0.38:8084 (Tailscale, CT 107) | Headscale |
| vpn.echo6.co/admin* | 100.64.0.38:3100 (Tailscale, CT 107) | Headplane |
| autodiscover.echo6.co | — | Mailcow autodiscover — moved to **edge1** (10.10.10.2:8453); not on edge2 |
| autoconfig.echo6.co | — | Mailcow autoconfig — moved to **edge1** (10.10.10.2:8453); not on edge2 |
| vault.echo6.co | 100.64.0.33:8086 (Tailscale, CT 102) | vaultwarden |
| proxmox.echo6.co | https://100.64.0.6:8006 (via Tailscale) | Proxmox VE (data node) — unchanged |
| wt.echo6.co | — | ~~WATCHTOWER ops dashboard~~ — **decommissioned 2026-06-16** (was 100.64.0.1, now dead) |
| matrix.echo6.co | 100.64.0.37:8008 + 100.64.0.37:8085 (Tailscale, CT 106) | Matrix [[synapse]] + MAS (login/logout/refresh/auth_metadata → MAS:8085, _matrix/* → [[synapse]]:8008, default → MAS:8085) |
| element.echo6.co | 100.64.0.37:8088 (Tailscale, CT 106) | Element Web client |
| notes.echo6.co | 100.64.0.35:5984 + 100.64.0.35:5985 (Tailscale, CT 104) | LiveSync (CouchDB + provisioner, forward auth on /_provision*, CORS for Obsidian) |
| tak.echo6.co | — | ~~TAK Server admin + SIGIL console~~ — **decommissioned 2026-06-16** (was 100.64.0.1, now dead) |
### Commands
```bash
ssh root@100.64.0.1
ssh edge2
caddy validate --config /etc/caddy/Caddyfile
systemctl restart caddy # admin off, so reload won't work
journalctl -u caddy -f
@ -88,10 +90,12 @@ ssh root@192.168.1.241 'pct exec 101 -- journalctl -u caddy -f'
---
## dnsmasq (Tailscale Split DNS)
## dnsmasq (Tailscale Split DNS) — HISTORICAL / OBSOLETE
**Config:** `/etc/dnsmasq.d/tailscale-dns.conf` on Contabo
**Listens on:** 100.64.0.1:53
> **Not in use.** Tailnet split-DNS for echo6.co was retired: echo6.co now resolves via public GoDaddy DNS, not internal dnsmasq (see [[services]]). This section documents the OLD setup that ran on the original Contabo VPS (100.64.0.1) before its 2026-06-19 rebuild into edge1 (mail-only). That host and its 100.64.0.1 tailnet identity are dead — do not repoint these records to edge1 or edge2; kept below for historical reference only.
**Config:** `/etc/dnsmasq.d/tailscale-dns.conf` on Contabo (dead host, pre-2026-06-19)
**Listens on:** 100.64.0.1:53 (dead)
### Current Records
@ -121,6 +125,7 @@ ssh root@192.168.1.241 'pct exec 101 -- journalctl -u caddy -f'
### Commands
```bash
# HISTORICAL — host is dead, commands no longer work
ssh root@100.64.0.1
nano /etc/dnsmasq.d/tailscale-dns.conf
systemctl restart dnsmasq
@ -131,21 +136,31 @@ dig +short forge.echo6.co @100.64.0.1 # Test
## GoDaddy DNS Records (echo6.co)
### Contabo Services → 5.189.158.149
### edge2 Services → 184.174.35.153
| Subdomain | Service |
|-----------|---------|
| auth | Authentik SSO |
| forge | Forgejo Git |
| mail | Mailcow Email |
| vpn | Headscale VPN |
| vault | Vaultwarden |
| wt | WATCHTOWER ops dashboard |
| matrix | Matrix Synapse |
| element | Element Web |
| notes | LiveSync (CouchDB + provisioner) |
| proxmox | Proxmox VE (via Tailscale to data node) |
| tak | TAK Server + SIGIL |
### edge1 Services (mail-only host) → 5.189.158.149
| Subdomain | Service |
|-----------|---------|
| mail | Mailcow Email |
### Decommissioned records (removed from GoDaddy, 2026-06-16)
| Subdomain | Service |
|-----------|---------|
| wt | ~~WATCHTOWER ops dashboard~~ |
| tak | ~~TAK Server + SIGIL~~ |
### Home Services → 199.6.36.163
@ -181,7 +196,7 @@ dig +short forge.echo6.co @100.64.0.1 # Test
## Headscale Config
**Location:** `/opt/headscale/` on Contabo
**Location:** `/opt/headscale/` on edge2 (CT 107, managed via `headscale-stack.service` systemd reboot guard)
**Data:** Named Docker volume `headscale_headscale-data`
**Config:** `/opt/headscale/config.yaml`
@ -197,32 +212,37 @@ oidc:
client_id: "headscale"
```
**Split [[dns]]:** Configured via dnsmasq on Contabo.
**Split [[dns]]:** Previously configured via dnsmasq on Contabo (pre-2026-06-19). Not verified on edge2/edge1 in this pass — flagged stale/unresolved; see `## dnsmasq (Tailscale Split DNS)` section below (also unverified).
**Headplane:** Deployed at `vpn.echo6.co/admin` - OIDC via Authentik. First login gets Owner.
---
## Port Map (Contabo)
## Port Map (edge2)
| Service | Container Port | Host Binding (Tailscale) | Public Domain |
|---------|---------------|--------------|---------------|
| Authentik | 9000 | 100.64.0.36:9000 (CT 105) | auth.echo6.co |
| Forgejo | 3000 | 100.64.0.34:3001 (CT 103) | forge.echo6.co |
| Forgejo SSH | 22 | edge2 iptables DNAT :2222 → 100.64.0.34:2222 (CT 103) | Direct (not proxied) |
| Headscale | 8080 | 100.64.0.38:8084 (CT 107) | vpn.echo6.co |
| Headplane | 3000 | 100.64.0.38:3100 (CT 107) | vpn.echo6.co/admin |
| Vaultwarden | 80 | 100.64.0.33:8086 (CT 102) | vault.echo6.co |
| Vaultwarden WS | 3012 | 100.64.0.33:3012 (CT 102) | vault.echo6.co/notifications/hub |
| ~~WATCHTOWER~~ | 8084 | — | ~~wt.echo6.co~~ — decommissioned 2026-06-16 |
| Matrix Synapse | 8008 | 100.64.0.37:8008 (CT 106) | matrix.echo6.co (/_matrix/*, /_synapse/*) |
| Matrix MAS | 8080 | 100.64.0.37:8085 (CT 106) | matrix.echo6.co (login/logout/refresh/auth_metadata, default) |
| Element Web | 80 | 100.64.0.37:8088 (CT 106) | element.echo6.co |
| LiveSync CouchDB | 5984 | 100.64.0.35:5984 (CT 104) | notes.echo6.co |
| LiveSync Provisioner | 8080 | 100.64.0.35:5985 (CT 104) | notes.echo6.co/_provision/* |
| ~~TAK Server Admin~~ | 8446 | — | ~~tak.echo6.co~~ — decommissioned 2026-06-16 |
| ~~SIGIL Console~~ | 8990 | — | ~~tak.echo6.co/sigil~~ — decommissioned 2026-06-16 |
## Port Map (edge1 — mail-only, separate host)
| Service | Container Port | Host Binding | Public Domain |
|---------|---------------|--------------|---------------|
| Authentik | 9000 | 127.0.0.1:9000 | auth.echo6.co |
| Forgejo | 3000 | 127.0.0.1:3001 | forge.echo6.co |
| Forgejo SSH | 22 | 0.0.0.0:2222 | Direct (not proxied) |
| Headscale | 8080 | 127.0.0.1:8084 | vpn.echo6.co |
| Headplane | 3000 | 127.0.0.1:3100 | vpn.echo6.co/admin |
| Mailcow | 8443 | 127.0.0.1:8443 | mail.echo6.co |
| Vaultwarden | 80 | 127.0.0.1:8086 | vault.echo6.co |
| Vaultwarden WS | 3012 | 127.0.0.1:3012 | vault.echo6.co/notifications/hub |
| WATCHTOWER | 8084 | host network :8099 | wt.echo6.co |
| Matrix Synapse | 8008 | 127.0.0.1:8008 | matrix.echo6.co (/_matrix/*, /_synapse/*) |
| Matrix MAS | 8080 | 127.0.0.1:8085 | matrix.echo6.co (login/logout/refresh/auth_metadata, default) |
| Element Web | 80 | 127.0.0.1:8088 | element.echo6.co |
| LiveSync CouchDB | 5984 | 127.0.0.1:5984 | notes.echo6.co |
| LiveSync Provisioner | 8080 | 127.0.0.1:5985 | notes.echo6.co/_provision/* |
| TAK Server Admin | 8446 | https://100.64.0.1:8446 (Tailscale) | tak.echo6.co |
| SIGIL Console | 8990 | 100.64.0.1:8990 | tak.echo6.co/sigil |
| Mailcow | 8453 | 10.10.10.2:8453 (CT 101, via edge1 host Caddy + DNAT) | mail.echo6.co, autodiscover.echo6.co, autoconfig.echo6.co |
---
*Last updated: 2026-04-13 — Audit sync: added MAS routing on matrix.echo6.co, lidarr/navidrome/vpn.idahomesh.com to utility Caddy, proxmox/tak to GoDaddy, removed ghost docs.echo6.co entries, added dnsmasq lidarr/navidrome*
*Last updated: 2026-07-11 — Flip off Contabo completed: "Contabo Caddy" section → "edge2 Caddy" (front door for auth/forge/vpn/vault/matrix/element/notes/proxmox, CTs verified against [[ip-allocation]]/[[services]]); Mailcow + autodiscover/autoconfig moved to edge1 (separate mail-only host, not on edge2); WATCHTOWER + TAK/SIGIL marked decommissioned (dead 100.64.0.1 backends removed); Headscale config location + Port Map updated to edge2; `ssh root@100.64.0.1` → `ssh edge2`. dnsmasq split-DNS section marked HISTORICAL/OBSOLETE (echo6.co split-DNS retired, ran on the dead pre-2026-06-19 Contabo host, not repointed to edge1/edge2 per [[services]]); GoDaddy DNS Records section corrected — edge2 services (auth/forge/vpn/vault/matrix/element/notes/proxmox) → 184.174.35.153, mail → edge1 5.189.158.149 (unchanged public IP), wt/tak marked as removed records. Prior: 2026-04-13 — Audit sync: added MAS routing on matrix.echo6.co, lidarr/navidrome/vpn.idahomesh.com to utility Caddy, proxmox/tak to GoDaddy, removed ghost docs.echo6.co entries, added dnsmasq lidarr/navidrome*

14
vault/docs/software/dns.md
View file

@ -10,7 +10,7 @@ related:
- [[expose-service-contabo]]
- [[headscale-onboard-node]]
- [[authentik-oidc-application]]
updated: 2026-06-18
updated: 2026-07-11
---
# GoDaddy DNS Management
@ -29,7 +29,8 @@ Stored in `/home/zvx/projects/.ref/credentials` as:
| Purpose | IP |
|---------|-----|
| External (home [[services]]) | `199.6.36.163` |
| Contabo Server | `5.189.158.149` |
| edge1 (mail/autodiscover/autoconfig only — mail-only host, rebuilt 2026-06-19) | `5.189.158.149` |
| edge2 (front door: auth/forge/vpn/vault/matrix/element/notes/proxmox) | `184.174.35.153` |
## Managed Domains
@ -67,9 +68,14 @@ godaddy-dns.py setup-mail
godaddy-dns.py add-a echo6.co newservice 199.6.36.163
```
### Point subdomain to Contabo
### Point subdomain to edge2 (front door — auth, forge, vpn, vault, matrix, element, notes, proxmox)
```bash
godaddy-dns.py add-a echo6.co auth 5.189.158.149
godaddy-dns.py add-a echo6.co auth 184.174.35.153
```
### Point subdomain to edge1 (mail, autodiscover, autoconfig only)
```bash
godaddy-dns.py add-a echo6.co mail 5.189.158.149
```
### Create CNAME alias

18
vault/docs/software/recon.md
View file

@ -10,7 +10,7 @@ related:
- [[services]]
- [[usenet]]
- [[caddy]]
updated: 2026-06-18
updated: 2026-07-11
---
# RECON — Knowledge Extraction Pipeline
@ -40,8 +40,8 @@ RECON extracts knowledge from PDFs and web content into a searchable vector data
| Vector DB | Qdrant | cortex:6333 (Docker) |
| Embeddings | TEI (bge-m3, 1024-dim) | cortex:8090 (Docker) |
| Sparse embeddings | recon-sparse (bge-m3 SPLADE) | cortex:8091 (systemd) |
| Enrichment | Gemini `gemini-2.5-flash-lite` (enforced) | Google API (4 keys) |
| Vision Ocr | Gemini 2.5 Flash Lite | Google API (shared keys) |
| Enrichment | Gemini `gemini-3.1-flash-lite` (enforced) | Google API (4 keys) |
| Vision Ocr | gemini-3.1-flash-lite | Google API (shared keys) |
| Text extraction | PyPDF2, poppler-utils, Tesseract | Local |
| PDF source | NFS | pi-nas:/export/library → /mnt/library |
| File server | nginx | localhost:8888 → files.echo6.co |
@ -62,7 +62,7 @@ Per page, in order. Each method only runs if the previous returned <50 chars:
1. **PyPDF2** — fast, free, works on text-based PDFs
2. **pdftotext** (poppler) — handles some PDFs PyPDF2 misses
3. **Tesseract OCR** — renders page to image, runs local OCR
4. **Gemini Vision** — renders page to PNG, sends to Gemini 2.5 Flash Lite vision API
4. **Gemini Vision** — renders page to PNG, sends to gemini-3.1-flash-lite vision API
Method tracking saved in `data/text/{hash}/meta.json` as `ocr_methods` dict.
@ -88,7 +88,7 @@ Key sections:
- `processing.extract_workers` (4), `enrich_workers` (16), `embed_workers` (4)
- `processing.extract_timeout` (1800s), `page_timeout` (30s)
- `processing.enrich_max_retries` (5), `enrich_base_delay` (5.0)
- `gemini.model` (gemini-2.5-flash-lite), `gemini.response_mime_type` (application/json)
- `gemini.model` (gemini-3.1-flash-lite), `gemini.response_mime_type` (application/json)
- `service.scan_interval` (3600), `stage_poll_interval` (30)
**API keys:** `/opt/recon/.env` — GEMINI_KEY_1 through GEMINI_KEY_4
@ -112,10 +112,10 @@ Key sections:
## Backups
- **Destination:** `root@100.64.0.1:/opt/backups/recon/`
- **Destination:** `root@100.64.0.40:/opt/backups/recon/` (edge1 — retains the storage/public IP post-rebuild)
- **Full sync:** every 6 hours (concepts, text, DB, config)
- **DB snapshot:** every 2 hours
- **Recovery:** restore from Contabo → `recon rebuild` (reconstructs Qdrant from concept JSONs)
- **Recovery:** restore from edge1 → `recon rebuild` (reconstructs Qdrant from concept JSONs)
- **Critical data:** `data/concepts/` — Gemini extraction work, costs money to regenerate
## Key Files
@ -134,7 +134,7 @@ Key sections:
│ ├── status.py # SQLite DB (WAL, thread-safe)
│ └── utils.py # Config, hashing, logging
├── scripts/
│ ├── backup.sh # Backup to Contabo
│ ├── backup.sh # Backup to edge1
│ ├── validate.py # Pipeline consistency checker
│ └── rebuild_qdrant.py # Nuclear Qdrant rebuild
└── data/
@ -145,4 +145,4 @@ Key sections:
---
*Last updated: 2026-06-18 — Updated: repo/branch, recon-sparse :8091, recon_knowledge_hybrid collection, Entrypoints; PROJECT-BIBLE.md dated 2026-02-16 (predates current deployment) — verified against live 2026-06-18*
*Last updated: 2026-07-11 — Gemini model refs updated to gemini-3.1-flash-lite (retired gemini-2.5-flash-lite); backup destination corrected Contabo (100.64.0.1, dead) → edge1 (100.64.0.40). Prior: 2026-06-18 — Updated: repo/branch, recon-sparse :8091, recon_knowledge_hybrid collection, Entrypoints; PROJECT-BIBLE.md dated 2026-02-16 (predates current deployment) — verified against live 2026-06-18*

5
vault/docs/software/searxng.md
View file

@ -10,7 +10,7 @@ related:
- [[ip-allocation]]
- [[headscale-onboard-node]]
- [[services]]
updated: 2026-06-18
updated: 2026-07-11
---
# SearXNG — Echo6 Search Homepage
@ -132,8 +132,9 @@ curl -s http://192.168.1.102:8080 | head -30
- `echo6.co` → `100.64.0.15:8080` + Matrix `.well-known` handlers
- `search.echo6.co` → 301 redirect to `https://echo6.co`
**dnsmasq (Contabo):**
**dnsmasq (historical — this ran on Contabo, decommissioned 2026-06-19):**
- `echo6.co` → `100.64.0.8` (utility Caddy)
- Per [[services]]: tailnet split-DNS is NOT used for `echo6.co` — it resolves via public GoDaddy DNS. This dnsmasq entry describes the pre-migration setup and should not be assumed current.
**GoDaddy [[dns]]:**
- `@` (echo6.co) → `199.6.36.163` (home)