auto: docs sync 2026-07-13T12:00:23+00:00
Files changed: engine/.embcache.json engine/changelog.md engine/lint-report.md vault/.trash/2026-06-19.md vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/matrix/archivist.md vault/docs/matrix/matrix_host.md vault/docs/matrix/mautrix_signal.md vault/docs/matrix/synapse.md vault/docs/matrix/synapse_retention_discovery.md vault/docs/navi/cc-rules.md vault/docs/navi/deployment.md vault/docs/navi/themes.md vault/docs/services/ots-setup.md vault/docs/services/services.md vault/docs/services/usenet.md vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/central.md vault/docs/software/dns.md vault/docs/software/geo-tools.md vault/docs/software/navi.md vault/docs/software/recon.md vault/docs/software/searxng.md vault/glossary.md vault/notes/echo6-landing-page-data-export.md vault/notes/ia-download-queue.md vault/projects/advbbs-project.md vault/projects/argus.md vault/projects/deploy-livesync.md vault/projects/fleet-patch-audit.md vault/projects/fleet-platform-baseline.md vault/projects/matrix-synapse-deployment.md vault/projects/meshai-config-hot-apply.md vault/projects/meshai-region-routing-plan.md vault/projects/meshai.md vault/projects/meshcore-transport.md vault/projects/meshtastic-headscale-runbook.md vault/projects/mmud-project.md vault/projects/nominatim-v5-reimport.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/authentik-create-invitation.md vault/runbooks/authentik-oidc-application.md vault/runbooks/authentik-upgrade.md vault/runbooks/central-deploy-cutover.md vault/runbooks/ct-runbook.md vault/runbooks/edge2-access-reference.md vault/runbooks/expose-service-contabo.md vault/runbooks/expose-service-edge2.md vault/runbooks/expose-service-home.md vault/runbooks/fleet-magicdns-resolved-migration.md vault/runbooks/headless-browser-page-verification.md vault/runbooks/headscale-oidc-boot-order.md vault/runbooks/headscale-onboard-node.md vault/runbooks/ia-cli-reference.md vault/runbooks/ia-download-mirror.md vault/runbooks/idahomesh-bridge-setup.md vault/runbooks/idahomesh-vpn-device-setup.md vault/runbooks/lxc-service-migration.md vault/runbooks/mailcow-create-mailbox.md vault/runbooks/meshai-prod-compose-override.md vault/runbooks/meshmonitor-password-reset.md vault/runbooks/meshtastic-sidecar-node.md vault/runbooks/meshtasticd-sim-nodes-runbook.md vault/runbooks/nordvpn-lxc.md vault/runbooks/peertube-remote-runner.md vault/runbooks/pg-backup.md vault/runbooks/pi-nas-omv-runbook.md vault/runbooks/pipeline-patterns.md vault/runbooks/proxmox-create-ubuntu-vm.md vault/runbooks/proxmox-onboard-node.md vault/runbooks/pymc-repeater-kiss-tnc-reenumeration.md vault/runbooks/recon-operations.md vault/runbooks/recon-service-integration.md vault/runbooks/syncthing-add-node.md vault/runbooks/toc-cortex-pve9.2-update.md vault/session-resume/SESSION-HANDOFF-meshai-test.md
This commit is contained in:
echo6-autocommit
parent
7931172cb7
commit
ef8b1e0bd9
79 changed files with 448 additions and 360 deletions
|
|
@ -7,10 +7,10 @@ aliases: []
|
|||
related:
|
||||
- [[meshtastic-sidecar-node]]
|
||||
- [[meshtasticd-sim-nodes-runbook]]
|
||||
- [[mautrix_signal]]
|
||||
- [[mmud-project]]
|
||||
- [[meshtastic-headscale-runbook]]
|
||||
- [[services]]
|
||||
updated: 2026-06-18
|
||||
- [[mautrix_signal]]
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# advBBS — Claude Code Project Context
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ related:
|
|||
- [[ip-allocation]]
|
||||
- [[caddy]]
|
||||
- [[ct-runbook]]
|
||||
- [[ots-setup]]
|
||||
updated: 2026-06-18
|
||||
- [[services]]
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# ARGUS - OSINT Intelligence Platform
|
||||
|
||||
|
|
@ -71,7 +71,7 @@ ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) i
|
|||
**Registration:** `tailscale up --login-server=https://vpn.echo6.co --authkey=<key> --ssh --accept-routes`
|
||||
|
||||
**[[dns]] Bootstrap Fix:**
|
||||
Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback [[dns]] (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg DNS resolution failures on reboot.
|
||||
Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback [[dns]] (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg [[dns]] resolution failures on reboot.
|
||||
|
||||
```bash
|
||||
[Service]
|
||||
|
|
@ -321,4 +321,4 @@ pct status 103 --verbose
|
|||
---
|
||||
|
||||
**Provisioned by:** Claude Code
|
||||
**Container ready for:** ARGUS application deployment
|
||||
**Container ready for:** ARGUS application [[deployment]]
|
||||
|
|
|
|||
|
|
@ -8,13 +8,13 @@ related:
|
|||
- [[authentik-oidc-application]]
|
||||
- [[authentik]]
|
||||
- [[authentik-access-groups]]
|
||||
- [[expose-service-home]]
|
||||
- [[authentik-upgrade]]
|
||||
updated: 2026-06-18
|
||||
- [[headscale-oidc-boot-order]]
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# Deploying CouchDB with JWT auth for Obsidian LiveSync via Authentik
|
||||
|
||||
**LiveSync has native client-side JWT support that eliminates the need for a browser-based OIDC flow.** The plugin generates and signs JWTs internally using a stored private key, sending `Authorization: Bearer` headers directly to CouchDB. This fundamentally changes the architecture: instead of proxying OIDC tokens, you provision per-user key pairs, configure CouchDB with the public keys, and distribute setup URIs containing the private keys. [[authentik]] serves as the identity backbone for a provisioning service — not as a runtime token issuer. No one has publicly documented a complete LiveSync + SSO [[deployment]], making this guide a synthesis of the Kishieel Keycloak series, CouchDB JWT internals, Authentik's claim customization, and the LiveSync plugin's JWT implementation.
|
||||
**LiveSync has native client-side JWT support that eliminates the need for a browser-based OIDC flow.** The plugin generates and signs JWTs internally using a stored private key, sending `Authorization: Bearer` headers directly to CouchDB. This fundamentally changes the architecture: instead of proxying OIDC tokens, you provision per-user key pairs, configure CouchDB with the public keys, and distribute setup URIs containing the private keys. [[authentik]] serves as the identity backbone for a provisioning service — not as a runtime token issuer. No one has publicly documented a complete LiveSync + SSO [[deployment]], making this guide a synthesis of the Kishieel Keycloak series, CouchDB JWT internals, [[authentik]]'s claim customization, and the LiveSync plugin's JWT implementation.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -107,7 +107,7 @@ This iterates all user groups, extracts the `couchdb_role` attribute where it ex
|
|||
|
||||
## LiveSync's native JWT: how the plugin signs its own tokens
|
||||
|
||||
The Obsidian LiveSync plugin has **built-in JWT generation** that changes the deployment model fundamentally. Instead of obtaining tokens from an IdP at runtime, the plugin stores a private key and signs short-lived JWTs client-side. The relevant plugin settings are:
|
||||
The Obsidian LiveSync plugin has **built-in JWT generation** that changes the [[deployment]] model fundamentally. Instead of obtaining tokens from an IdP at runtime, the plugin stores a private key and signs short-lived JWTs client-side. The relevant plugin settings are:
|
||||
|
||||
| Setting | Type | Default | Purpose |
|
||||
|---------|------|---------|---------|
|
||||
|
|
@ -236,7 +236,7 @@ notes.echo6.co {
|
|||
|
||||
Given the constraints — LiveSync can't do OIDC flows, but it can sign JWTs client-side — the architecture has three components:
|
||||
|
||||
**1. CouchDB container** at `notes.echo6.co` behind Caddy, configured with JWT auth handler, CORS, and per-user databases with `_security` documents.
|
||||
**1. CouchDB container** at `notes.echo6.co` behind [[caddy]], configured with JWT auth handler, CORS, and per-user databases with `_security` documents.
|
||||
|
||||
**2. A provisioning service** (a small web app hosted on `forge.echo6.co` or as a Docker container) that:
|
||||
- Is protected by Authentik forward auth (browser-based OIDC login)
|
||||
|
|
|
|||
|
|
@ -3,9 +3,14 @@ title: Fleet Patch Audit — 2026-06-19
|
|||
type: project
|
||||
tags:
|
||||
- proxmox
|
||||
- ai
|
||||
related: []
|
||||
updated: 2026-06-22
|
||||
aliases: []
|
||||
related:
|
||||
- [[fleet-platform-baseline]]
|
||||
- [[lxc-service-migration]]
|
||||
- [[caddy]]
|
||||
- [[services]]
|
||||
- [[ip-allocation]]
|
||||
updated: 2026-07-13
|
||||
status: complete
|
||||
---
|
||||
|
||||
|
|
@ -13,7 +18,7 @@ status: complete
|
|||
|
||||
Read-only audit snapshot as of 2026-06-19. **Nothing has been applied — this is a planning document to build the patch plan from.**
|
||||
|
||||
**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No services route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149).
|
||||
**Topology note:** the old Contabo VPS has been rebuilt as **edge1 (mail-only)**; **edge2 is now the front door for everything else**. edge1 is excluded from this audit (mid-rebuild/maintenance). **Headscale:** edge2 CT107 is the main fleet tailnet (34 nodes, `vpn.echo6.co`, self-hosted Headscale 0.28.0); utility CT106 is a separate IdahoMesh sub-tailnet (`vpn.idahomesh.com`, 3 nodes, low-risk). No [[services]] route through old-Contabo. **Mailcow CT108:** destroyed 2026-06-20 (`pct destroy 108 --purge`); backup preserved durably on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified); live mail on edge1 (MX/A for mail.echo6.co → 5.189.158.149).
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -22,7 +27,7 @@ Read-only audit snapshot as of 2026-06-19. **Nothing has been applied — this i
|
|||
**Phases 1–3 are fully done. The entire fleet is on the current platform.**
|
||||
|
||||
- **Phase 1** (guest/VM security apt) — COMPLETE 2026-06-20. 26 guests patched, ~600+ security packages cleared, zero data loss.
|
||||
- **Phase 2** (app/container updates) — COMPLETE 2026-06-21. All app upgrades done: Authentik 2025.12.4→2026.5.3 (sequential), Forgejo 14→15, Headscale 0.28→0.29.1 (both instances), Immich 2.5.6→2.7.5, Nextcloud AIO→NC 33.0.5, media stack (Jellyfin/SABnzbd/arr), cortex AI stack (Ollama/TEI/Qdrant/Open-WebUI), and the low-urgency batch.
|
||||
- **Phase 2** (app/container updates) — COMPLETE 2026-06-21. All app upgrades done: [[authentik]] 2025.12.4→2026.5.3 (sequential), Forgejo 14→15, Headscale 0.28→0.29.1 (both instances), Immich 2.5.6→2.7.5, Nextcloud AIO→NC 33.0.5, media stack (Jellyfin/SABnzbd/arr), cortex AI stack (Ollama/TEI/Qdrant/Open-WebUI), and the low-urgency batch.
|
||||
- **Phase 3** (platform/reboot windows) — COMPLETE 2026-06-22. All 5 PVE nodes on 9.2.3/kernel 7.0.12-1-pve (including toc+cortex); pi-nas on OMV 8.4/kernel 6.18; cortex NVIDIA driver 580.167.08 + DKMS + nvidia-container-toolkit 1.19.1; GPU passthrough (vfio) survived the 7.0 kernel; cluster 5/5 quorate.
|
||||
|
||||
**Intentionally deferred / out of scope (not failures):**
|
||||
|
|
@ -42,12 +47,12 @@ These containers have the highest raw security-update counts and have not been p
|
|||
| Host | Guest | Upgradable / Security | Notes |
|
||||
|------|-------|-----------------------|-------|
|
||||
| utility | CT119 mesh-territory | 179 / 91 sec | Never patched |
|
||||
| utility | CT108 meshai | 109 / 79 | — |
|
||||
| utility | CT108 [[meshai]] | 109 / 79 | — |
|
||||
| cloud | CT120 immich guest-OS | 191 / 101 | — |
|
||||
| cloud | CT121 nextcloud guest-OS | 98 / 75 | — |
|
||||
| media | CT110 peertube | 81 / 37 | — |
|
||||
| utility | CT109 opentakserver | 34 / 31 | — |
|
||||
| utility | CT104 central | 50 / 38 | Includes PostgreSQL 16.13 → 16.14 |
|
||||
| utility | CT104 [[central]] | 50 / 38 | Includes PostgreSQL 16.13 → 16.14 |
|
||||
|
||||
### Tier 2 — App / Container Updates
|
||||
|
||||
|
|
@ -58,7 +63,7 @@ Updates where the application or its Docker images have drifted from current ups
|
|||
| edge2 | CT105 | authentik 2025.12.4 → 2026.5.3 | **#1 security item** — 7 CVEs + 5 GHSAs in gap; sequential upgrade (min: 2025.12.6) |
|
||||
| edge2 | CT107 | headscale 0.28.0 → 0.29.1 | Also a 2nd headscale on utility CT106 |
|
||||
| edge2 | CT103 | forgejo 14.0.5 → 15.0.3 | **14.x EOL 2026-04-30** — migrate branch, not just patch |
|
||||
| edge2 | CT106 | Synapse 1.155.0 / Element / MAS | Image drift + pending OS apt security updates |
|
||||
| edge2 | CT106 | [[synapse]] 1.155.0 / Element / MAS | Image drift + pending OS apt security updates |
|
||||
| edge2 | CT104 | livesync couchdb:3.4 | Docker image drift |
|
||||
| edge2 | CT108 | ~~mailcow (18 containers)~~ | ✅ **Decommissioned 2026-06-20** — superseded by edge1; no longer an update target |
|
||||
| cloud | CT120 | immich — server/ml/valkey:9/postgres(14-vectorchord) | 4 images drifted |
|
||||
|
|
@ -98,10 +103,10 @@ Issues noted that are not package/image updates but warrant attention.
|
|||
| Host / Guest | Flag | Detail |
|
||||
|---|---|---|
|
||||
| data | Disk 92% full | ~73 GB / 938 GB free; address before patching |
|
||||
| utility CT118 archivist | rpcbind on 0.0.0.0:111 | No Tailscale client or firewall on this CT; exposed port |
|
||||
| utility CT118 [[archivist]] | rpcbind on 0.0.0.0:111 | No Tailscale client or firewall on this CT; exposed port |
|
||||
| media VM105 jellyseerr | Non-stable image | Running preview-OIDC tag, not a stable release |
|
||||
| data VM1130 nominatim | Stale image (14 months) | nominatim:4.5, pinned; confirm intentional |
|
||||
| edge2 CT106 matrix / CT107 headscale | No Tailscale client | Ingress via Caddy; verify internal routing before patching |
|
||||
| edge2 CT106 matrix / CT107 headscale | No Tailscale client | Ingress via [[caddy]]; verify internal routing before patching |
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -138,15 +143,15 @@ Running application version vs latest stable upstream, per app — the "is every
|
|||
|
||||
### Current / already past the fix (no action)
|
||||
|
||||
Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/themes (edge2 CT101) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
|
||||
Vaultwarden 1.36.0 (edge2 CT102 — has the SSO-takeover/org-access CVE fixes) · PDM 1.1.4 (edge2 CT100 — past the RCE PSA) · WordPress 7.0 core + all plugins/[[themes]] (edge2 CT101) · Synapse 1.155.0 / Element / MAS (edge2 CT106 — current, only minor `:latest` digest drift) · obsidian-remote v1.12.7 (cortex) · PostgreSQL 16.14 (recon-vm).
|
||||
|
||||
### Lower urgency
|
||||
|
||||
Mumble 1.5.517→1.5.901 · Caddy 2.10.2/2.11.3→2.11.4 · Qdrant 1.16.3→1.18.2 · TEI 1.7.4→1.9.3 · Valhalla 3.6.3→3.7.0 · Photon 1.1.0→1.2.0 · kiwix 3.7.0→3.8.2 · CouchDB 3.4.3→3.5.2 (livesync) · Navidrome 0.60.3→0.62.0 · Sonarr/Radarr/Prowlarr/Lidarr 1–2 versions · NATS 2.14.0→2.14.2 · PostgreSQL 16.12/16.13→16.14 · meshmonitor (~1 mo, exact ver undeterminable) · searxng (rolling, ~4.5 mo) + valkey-8 sidecar 8.1.5→8.1.8 · mautrix-signal v0.2603.0.
|
||||
Mumble 1.5.517→1.5.901 · Caddy 2.10.2/2.11.3→2.11.4 · Qdrant 1.16.3→1.18.2 · TEI 1.7.4→1.9.3 · Valhalla 3.6.3→3.7.0 · Photon 1.1.0→1.2.0 · kiwix 3.7.0→3.8.2 · CouchDB 3.4.3→3.5.2 (livesync) · Navidrome 0.60.3→0.62.0 · Sonarr/Radarr/Prowlarr/Lidarr 1–2 versions · NATS 2.14.0→2.14.2 · PostgreSQL 16.12/16.13→16.14 · meshmonitor (~1 mo, exact ver undeterminable) · [[searxng]] (rolling, ~4.5 mo) + valkey-8 sidecar 8.1.5→8.1.8 · [[mautrix_signal]] v0.2603.0.
|
||||
|
||||
### Internal echo6 apps (no upstream to track)
|
||||
|
||||
central-*, meshai, archivist, meshwars, recon / recon-watchdog, navi-* — running; version = current git head.
|
||||
central-*, meshai, archivist, meshwars, [[recon]] / recon-watchdog, navi-* — running; version = current git head.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -240,7 +245,7 @@ Lowest-risk changes first; everything reboot-bearing deferred to scheduled windo
|
|||
|
||||
### Incidental fixes made during Phase 1
|
||||
|
||||
- **(a) CT110 peertube — immutable `/etc/resolv.conf` blocked reboot.** The file had `chattr +i` set (intentional NordVPN DNS protection). Cleared the immutable flag to allow the reboot, then verified the flag was restored and DNS remained healthy after boot.
|
||||
- **(a) CT110 peertube — immutable `/etc/resolv.conf` blocked reboot.** The file had `chattr +i` set (intentional NordVPN [[dns]] protection). Cleared the immutable flag to allow the reboot, then verified the flag was restored and DNS remained healthy after boot.
|
||||
- **(b) CT111 mcc — DNS hijacked to unreachable MagicDNS.** Tailscale `accept-dns` was redirecting DNS to a MagicDNS address that was not reachable from this CT. Disabled `tailscale accept-dns`, set `1.1.1.1` / `8.8.8.8` persistently.
|
||||
- **(c) PostgreSQL on central CT104 moved 16.13→16.14** as part of the security-pocket apt pass.
|
||||
- **(d) Fleet-wide stale `/etc/hosts` fix** — see Critical Finding 2.
|
||||
|
|
@ -268,7 +273,7 @@ Known minor leftover (cosmetic, non-blocking): CT107's OWN tailscale client node
|
|||
|
||||
### 🔴 Critical Finding 2 — fleet-wide stale /etc/hosts broke coordinator connectivity
|
||||
|
||||
7 fleet nodes — data, cloud, media, utility hosts, plus caddy CT101, cobalt CT112, and peertube CT110 — had a stale `5.189.158.149 vpn.echo6.co` line in `/etc/hosts` left over from before the 2026-06-19 headscale migration to edge2. This pinned `vpn.echo6.co` to edge1 (now mail-only), so tailscaled hit Mailcow's TLS cert and could never reach the real coordinator — affected nodes showed OFFLINE in headscale while coasting on persistent WireGuard tunnels (still SSH-reachable, masking the problem).
|
||||
7 fleet nodes — data, cloud, media, utility hosts, plus caddy CT101, cobalt CT112, and peertube CT110 — had a stale `5.189.158.149 vpn.echo6.co` line in `/etc/hosts` left over from before the [[2026-06-19]] headscale migration to edge2. This pinned `vpn.echo6.co` to edge1 (now mail-only), so tailscaled hit Mailcow's TLS cert and could never reach the real coordinator — affected nodes showed OFFLINE in headscale while coasting on persistent WireGuard tunnels (still SSH-reachable, masking the problem).
|
||||
|
||||
**Fixed 2026-06-20:** removed the stale line and ran `tailscale up` on all 7; all confirmed ONLINE in the coordinator. `/etc/hosts.bak-20260620` backups left on each host.
|
||||
|
||||
|
|
@ -331,7 +336,7 @@ Empirically confirmed during the OTS update: updating OTS to 1.7.12 does **not**
|
|||
### Incidental fixes and side-work during Phase 2
|
||||
|
||||
- **CT107 boot-survival fix** (applied earlier in the effort, during Phase 1 resolution) — rebound headscale/headplane ports to 10.10.10.25, dropped `tailscale-online.target` dependency, disabled `only_start_if_oidc_is_available` gate, repointed edge2 Caddy; proven by reboot self-heal in ~45 s. Also corrected CT107's own tailscale node ControlURL to `vpn.echo6.co` so it self-registers cleanly.
|
||||
- **Utility node incident (resolved):** a batch delete of 9 LVM-thin snapshots triggered an SSD TRIM/discard storm that spiked I/O and load transiently; compounded by CT103 argus running hot (transcription + docker-compose build churn). Matt migrated argus to the cloud node, resolving the issue; utility load returned to normal. **LESSON: delete thin-pool snapshots one at a time — not in a batch — to avoid the discard storm.**
|
||||
- **Utility node incident (resolved):** a batch delete of 9 LVM-thin snapshots triggered an SSD TRIM/discard storm that spiked I/O and load transiently; compounded by CT103 [[argus]] running hot (transcription + docker-compose build churn). Matt migrated argus to the cloud node, resolving the issue; utility load returned to normal. **LESSON: delete thin-pool snapshots one at a time — not in a batch — to avoid the discard storm.**
|
||||
- **Nextcloud:** granted `matt@echo6.co` the NC admin role. (user_oidc has no group-claim sync, so this is durable across SSO logins.)
|
||||
- **Radarr:** set up a `\\192.168.1.160\manual` SMB drop folder on the same NFS export as the library (atomic-move imports) for manual movie filing.
|
||||
- **Snapshot hygiene:** all rollback snapshots cleaned up after validation — Phase 1 `presec-*`, Phase 2 `prewave2-*`, OTS `pre-ots-*` snapshots all removed.
|
||||
|
|
@ -362,7 +367,7 @@ Empirically confirmed during the OTS update: updating OTS to 1.7.12 does **not**
|
|||
|
||||
### Separate deferred projects
|
||||
|
||||
- Nominatim v5 re-import — see [[nominatim-v5-reimport]]
|
||||
- [[Nominatim v5 Re-import]] — see [[nominatim-v5-reimport]]
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -1,18 +1,22 @@
|
|||
---
|
||||
title: Fleet Platform Baseline — post-patch 2026-06-22
|
||||
type: reference
|
||||
type: project
|
||||
tags:
|
||||
- proxmox
|
||||
- ai
|
||||
aliases: []
|
||||
related:
|
||||
- projects/fleet-patch-audit
|
||||
updated: 2026-06-22
|
||||
- [[fleet-patch-audit]]
|
||||
- [[environment]]
|
||||
- [[toc-cortex-pve9.2-update]]
|
||||
- [[central]]
|
||||
- [[ip-allocation]]
|
||||
updated: 2026-07-13
|
||||
status: current
|
||||
---
|
||||
|
||||
# Fleet Platform Baseline — post-patch 2026-06-22
|
||||
|
||||
Point-in-time platform state after the 2026-06-19/22 patch campaign. Full campaign record and accepted caveats in [[fleet-patch-audit]].
|
||||
Point-in-time platform state after the [[2026-06-19]]/22 patch campaign. Full campaign record and accepted caveats in [[fleet-patch-audit]].
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -45,7 +49,7 @@ Ubuntu 24.04 (security-patched). PostgreSQL 16, Valhalla, Nominatim 4.5 (v5 defe
|
|||
|
||||
| App | Host | Version | Notes |
|
||||
|---|---|---|---|
|
||||
| Authentik | edge2 CT105 | 2026.5.3 | Fleet SSO |
|
||||
| [[authentik]] | edge2 CT105 | 2026.5.3 | Fleet SSO |
|
||||
| Forgejo | edge2 CT103 | 15.0.3 | — |
|
||||
| Headscale | edge2 CT107 | 0.29.1 | Fleet tailnet coordinator at `vpn.echo6.co`; boot-survival fixed (ports bound to 10.10.10.25, not tailscale IP) |
|
||||
| Headscale (IdahoMesh) | utility CT106 | 0.29.1 | Separate IdahoMesh mesh at `vpn.idahomesh.com` |
|
||||
|
|
@ -53,7 +57,7 @@ Ubuntu 24.04 (security-patched). PostgreSQL 16, Valhalla, Nominatim 4.5 (v5 defe
|
|||
| Immich | cloud CT120 | 2.7.5 | Photos on pi-nas NFS |
|
||||
| PeerTube | media CT110 | 8.2.1 | — |
|
||||
| OpenTAKServer | utility CT109 | 1.7.12 | RabbitMQ stays 3.12 by decision; MediaMTX 1.19.1; Mumble 1.5.517 |
|
||||
| Matrix/Synapse | edge2 CT106 | 1.155.0 | — |
|
||||
| Matrix/[[synapse]] | edge2 CT106 | 1.155.0 | — |
|
||||
| Vaultwarden | edge2 CT102 | 1.36.0 | — |
|
||||
| PDM | edge2 CT100 | 1.1.4 | — |
|
||||
| CouchDB/LiveSync | edge2 CT104 | 3.5.2 | — |
|
||||
|
|
|
|||
|
|
@ -7,15 +7,15 @@ aliases: []
|
|||
related:
|
||||
- [[synapse]]
|
||||
- [[matrix_host]]
|
||||
- [[mautrix_signal]]
|
||||
- [[caddy]]
|
||||
- [[mautrix_signal]]
|
||||
- [[lxc-service-migration]]
|
||||
updated: 2026-07-11
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# Matrix Synapse Deployment
|
||||
|
||||
**Status:** Deployed 2026-02-15, migrated to Contabo 2026-02-15. Migrated to edge2 CT 106 2026-06-19.
|
||||
**Target (historical, at time of deployment):** Contabo VPS (5.189.158.149 / 100.64.0.1)
|
||||
**Target (historical, at time of [[deployment]]):** Contabo VPS (5.189.158.149 / 100.64.0.1)
|
||||
**URLs:** https://matrix.echo6.co ([[synapse]]), https://element.echo6.co (Element Web)
|
||||
**Server Name:** echo6.co (federated identity: @user:echo6.co)
|
||||
|
||||
|
|
@ -27,9 +27,9 @@ updated: 2026-07-11
|
|||
|-----------|--------|
|
||||
| Host (historical, at deployment time) | Contabo VPS (5.189.158.149 / 100.64.0.1) |
|
||||
| Host (current) | edge2 CT 106 (100.64.0.37) — migrated 2026-06-18 |
|
||||
| Docker [[services]] | Synapse (127.0.0.1:8008), Element Web (127.0.0.1:8088), PostgreSQL 16 |
|
||||
| Docker [[services]] | [[synapse]] (127.0.0.1:8008), Element Web (127.0.0.1:8088), PostgreSQL 16 |
|
||||
| Reverse proxy (historical) | Contabo [[caddy]] (auto ACME certs) |
|
||||
| Reverse proxy (current) | edge2 host Caddy |
|
||||
| Reverse proxy (current) | edge2 host [[caddy]] |
|
||||
| SSO | [[authentik]] OIDC → communication-users group |
|
||||
| Federation | Well-known delegation on echo6.co base domain (served by utility Caddy) |
|
||||
| Compose path | `/opt/matrix/docker-compose.yml` |
|
||||
|
|
@ -264,7 +264,7 @@ matrix.echo6.co {
|
|||
### element.echo6.co
|
||||
|
||||
- Backend: `192.168.1.108:8080` (local IP)
|
||||
- Issue cert, install cert, add Caddy site block, add GoDaddy DNS
|
||||
- Issue cert, install cert, add Caddy site block, add GoDaddy [[dns]]
|
||||
|
||||
```caddyfile
|
||||
element.echo6.co {
|
||||
|
|
@ -413,7 +413,7 @@ Must return `true`.
|
|||
1. Open https://element.echo6.co
|
||||
2. Click SSO login
|
||||
3. Should redirect to auth.echo6.co → authenticate → redirect back to Element
|
||||
4. Verify user identity matches Authentik profile
|
||||
4. Verify user identity matches [[authentik]] profile
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -3,10 +3,14 @@ title: meshai Config Hot-Apply — Kill the Restart-Required GUI Friction
|
|||
type: project
|
||||
tags:
|
||||
- mesh
|
||||
aliases: []
|
||||
related:
|
||||
- [[meshai]]
|
||||
- [[meshai-region-routing-plan]]
|
||||
updated: 2026-07-07
|
||||
- [[meshai-prod-compose-override]]
|
||||
- [[meshai]]
|
||||
- [[SESSION-HANDOFF-meshai-test]]
|
||||
- [[meshcore-transport]]
|
||||
updated: 2026-07-13
|
||||
status: proposed
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -3,11 +3,14 @@ title: meshai Region × Family Routing — Implementation Plan
|
|||
type: project
|
||||
tags:
|
||||
- mesh
|
||||
aliases: []
|
||||
related:
|
||||
- [[meshai]]
|
||||
- [[meshai-config-hot-apply]]
|
||||
- [[meshai-prod-compose-override]]
|
||||
- [[meshcore-transport]]
|
||||
- [[meshai-fire-alerting-and-persistence]]
|
||||
updated: 2026-07-07
|
||||
- [[meshai]]
|
||||
- [[SESSION-HANDOFF-meshai-test]]
|
||||
updated: 2026-07-13
|
||||
status: proposed
|
||||
---
|
||||
|
||||
|
|
@ -15,7 +18,7 @@ status: proposed
|
|||
|
||||
> Produced by a local multi-agent ultraplan (3 planners → 3 judges → synthesize → 3 red-team critics → finalize), verified against prod code at commit ceb95fb.
|
||||
>
|
||||
> **Scope principle (Matt, 2026-07-07): build the PLUMBING, not automation.** meshai exposes the mechanism — region-tagged events + a compact `region_routes` matrix the dispatcher honors + a plain editor to set it. **Matt does all configuration by hand:** defines the region boxes, provisions the radio channels, fills each family×region→channel cell himself. meshai auto-creates nothing — no channels, no regions, no routes, no generated rule objects. "No sprawl" comes from the config being ONE compact object he edits, not from automation.
|
||||
> **Scope principle (Matt, 2026-07-07): build the PLUMBING, not automation.** [[meshai]] exposes the mechanism — region-tagged events + a compact `region_routes` matrix the dispatcher honors + a plain editor to set it. **Matt does all configuration by hand:** defines the region boxes, provisions the radio channels, fills each family×region→channel cell himself. meshai auto-creates nothing — no channels, no regions, no routes, no generated rule objects. "No sprawl" comes from the config being ONE compact object he edits, not from automation.
|
||||
|
||||
## 1. Verdict
|
||||
**GO, phased.** Achievable, mostly config/GUI once the keystone code gap is closed: **nothing currently writes `event.region` / `event.regions`** (`notifications/events.py:55-56` define them, the dispatcher *reads* them, zero writers exist). Close that and the existing region-scope machinery comes alive.
|
||||
|
|
|
|||
|
|
@ -3,15 +3,16 @@ title: meshai
|
|||
type: project
|
||||
tags:
|
||||
- mesh
|
||||
- ai
|
||||
aliases:
|
||||
- meshai
|
||||
- MeshAI
|
||||
related:
|
||||
- [[services]]
|
||||
- [[meshcore-transport]]
|
||||
- [[central]]
|
||||
updated: 2026-07-11
|
||||
- [[meshai-region-routing-plan]]
|
||||
- [[meshai-prod-compose-override]]
|
||||
- [[SESSION-HANDOFF-meshai-test]]
|
||||
- [[meshai-config-hot-apply]]
|
||||
updated: 2026-07-13
|
||||
---
|
||||
|
||||
# meshai
|
||||
|
|
@ -35,7 +36,7 @@ The LLM backend is gemini-3.1-flash-lite with Google Search grounding (multi-bac
|
|||
- **Liveness:** container healthcheck is a PID-file liveness probe (`/tmp/meshai.pid`), not an HTTP endpoint.
|
||||
- **Mesh link:** connects over **IP to MeshMonitor's virtual-node (vnode) service**, which fronts the actual Meshtastic radio (a meshtasticd node — ultimately AIDA-N2 / channel 8 on **aida-nebra**). Everything is over the network; there is no radio physically attached to the meshai host. meshai *can* also connect directly to a meshtasticd over TCP, but the deployed configuration routes over IP/TCP to MeshMonitor's virtual node.
|
||||
- **Source:** GitHub `origin` = `zvx-echo6/meshai`. Deploy = git pull + `docker compose build && up -d` (survives reboot).
|
||||
- **Distinct from** the [[central]] service (utility CT 104) — meshai is a *consumer* of Central's feed, not Central itself.
|
||||
- **Distinct from** the [[central]] service (utility CT 104) — meshai is a *consumer* of [[central]]'s feed, not Central itself.
|
||||
|
||||
## Architecture
|
||||
|
||||
|
|
@ -58,6 +59,6 @@ The pipeline is feeds → events → notifications → mesh, plus a separate inb
|
|||
|
||||
## Active / planned work
|
||||
|
||||
- [[meshcore-transport]] — proposed dual Meshtastic + MeshCore transport (send/receive on both meshes simultaneously; uniform message sizing to the smaller radio budget). Design agreed; open on hardware, the `meshcore` dependency, and branch timing.
|
||||
- [[meshcore-transport]] — proposed dual Meshtastic + [[meshcore-transport]] (send/receive on both meshes simultaneously; uniform message sizing to the smaller radio budget). Design agreed; open on hardware, the `meshcore` dependency, and branch timing.
|
||||
- NWS severity normalization — CAP-severity pre-filter removed; NWS breadth is now governed solely by the dashboard Weather toggle threshold (warnings broadcast immediately).
|
||||
- Fire-path correctness — WFIGS/FIRMS fire correlation and drain/pacer spam controls on the fire feed.
|
||||
|
|
|
|||
|
|
@ -9,14 +9,17 @@ aliases:
|
|||
- MeshCore transport for meshai
|
||||
related:
|
||||
- [[meshai]]
|
||||
- [[services]]
|
||||
updated: 2026-07-02
|
||||
- [[meshai-region-routing-plan]]
|
||||
- [[meshai-prod-compose-override]]
|
||||
- [[SESSION-HANDOFF-meshai-test]]
|
||||
- [[meshai-config-hot-apply]]
|
||||
updated: 2026-07-13
|
||||
status: proposed
|
||||
---
|
||||
|
||||
# MeshCore transport for meshai (dual Meshtastic + MeshCore)
|
||||
|
||||
Design for adding MeshCore as a second mesh transport to the meshai LLM mesh assistant ([[meshai]]), running alongside Meshtastic.
|
||||
Design for adding MeshCore as a second mesh transport to the [[meshai]] LLM mesh assistant ([[meshai]]), running alongside Meshtastic.
|
||||
|
||||
## Status
|
||||
|
||||
|
|
@ -41,7 +44,7 @@ Let meshai speak both **Meshtastic** and **MeshCore**, config-selectable as eith
|
|||
|
||||
## Companion vs client (how we connect to MeshCore)
|
||||
|
||||
MeshCore firmware is role-specific (flashed, not runtime): **Companion**, **Repeater**, **Room Server**. The **Companion** node is the one a computer attaches to and drives — analogous to Meshtastic's phone+node model. meshai attaches to a Companion-firmware radio via the official `meshcore` Python lib (asyncio). **TCP to a Companion node is the natural fit** here — either native-TCP MeshCore firmware or a `ser2net`/serial-to-IP bridge — matching meshai's all-over-IP deployment (the Meshtastic side already runs over IP to MeshMonitor's vnode). A USB-on-host radio is not how this deployment works. Avoid BLE on Linux. Broadcast to a channel with `send_chan_msg(index, text)`; channel 0 = "Public" (well-known PSK) = the broadcast primitive. Do NOT attach to a Repeater or Room Server for messaging.
|
||||
MeshCore firmware is role-specific (flashed, not runtime): **Companion**, **Repeater**, **Room Server**. The **Companion** node is the one a computer attaches to and drives — analogous to Meshtastic's phone+node model. meshai attaches to a Companion-firmware radio via the official `meshcore` Python lib (asyncio). **TCP to a Companion node is the natural fit** here — either native-TCP MeshCore firmware or a `ser2net`/serial-to-IP bridge — matching meshai's all-over-IP [[deployment]] (the Meshtastic side already runs over IP to MeshMonitor's vnode). A USB-on-host radio is not how this deployment works. Avoid BLE on Linux. Broadcast to a channel with `send_chan_msg(index, text)`; channel 0 = "Public" (well-known PSK) = the broadcast primitive. Do NOT attach to a Repeater or Room Server for messaging.
|
||||
|
||||
## Connecting to MeshCore via pyMC (companion TCP frame server)
|
||||
|
||||
|
|
@ -54,7 +57,7 @@ MeshCore firmware is role-specific (flashed, not runtime): **Companion**, **Repe
|
|||
|
||||
- **Meshtastic (today):** rich, global, passive picture via MeshView + MeshMonitor (fed by Meshtastic's MQTT firehose).
|
||||
- **MeshCore:** no MQTT firehose and no passive "every node ever heard" nodeDB — by design (privacy/routing model). Awareness is LOCAL/contact-scoped and mostly PULL-based.
|
||||
- **Convenient fit:** MeshMonitor (the same tool meshai already uses for Meshtastic) supports MeshCore as a first-class source since v4.5+, over USB/TCP, with a REST API (`/api/nodes`). So MeshCore awareness reuses the existing MeshMonitor pattern. MeshMonitor is already central to meshai's mesh connectivity — meshai's Meshtastic link itself runs over IP through MeshMonitor's vnode — which makes reusing MeshMonitor for MeshCore awareness an especially natural fit.
|
||||
- **Convenient fit:** MeshMonitor (the same tool meshai already uses for Meshtastic) supports MeshCore as a first-class source since v4.5+, over USB/TCP, with a REST API (`/api/nodes`). So MeshCore awareness reuses the existing MeshMonitor pattern. MeshMonitor is already [[central]] to meshai's mesh connectivity — meshai's Meshtastic link itself runs over IP through MeshMonitor's vnode — which makes reusing MeshMonitor for MeshCore awareness an especially natural fit.
|
||||
- **What we CAN give a MeshCore user's LLM query:** contact roster (name, node type, last-advert, position if shared, known path/hops via `get_contacts()`), per-message SNR/RSSI, own device telemetry, on-demand telemetry from other nodes (`req_telemetry`/`req_status`, Cayenne LPP), trace/path discovery. Repeater stats (uptime/airtime/neighbors) only if the operator enabled guest access.
|
||||
- **What's missing vs Meshtastic:** no global/passive view, no firehose, advert SNR/position not inline, companion has no neighbor table (only Repeaters do).
|
||||
- **Verdict:** less than Meshtastic's effortless global view, but a real local picture — plan MeshCore awareness around active polling of a curated contact/repeater set, not passive ingestion.
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ related:
|
|||
- [[idahomesh-vpn-device-setup]]
|
||||
- [[meshtastic-sidecar-node]]
|
||||
- [[headscale-onboard-node]]
|
||||
- [[caddy]]
|
||||
updated: 2026-07-11
|
||||
- [[services]]
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# IdahoMesh Tailnet Runbook
|
||||
|
||||
|
|
@ -644,7 +644,7 @@ Any tailscale client older than v1.80.0 will be rejected by 0.29. Verify all reg
|
|||
|
||||
- **Date:** 2026-06-21
|
||||
- **From:** v0.28.0 → **To:** v0.29.1
|
||||
- **Deployment:** native systemd binary at `/usr/local/bin/headscale`
|
||||
- **[[deployment]]:** native systemd binary at `/usr/local/bin/headscale`
|
||||
- **Config changes made:**
|
||||
- Removed `randomize_client_port: false`
|
||||
- Replaced `ephemeral_node_inactivity_timeout: 30m` with `node.ephemeral.inactivity_timeout: 30m`
|
||||
|
|
|
|||
|
|
@ -7,10 +7,10 @@ aliases: []
|
|||
related:
|
||||
- [[advbbs-project]]
|
||||
- [[meshtasticd-sim-nodes-runbook]]
|
||||
- [[meshai]]
|
||||
- [[ip-allocation]]
|
||||
- [[services]]
|
||||
- [[meshtastic-headscale-runbook]]
|
||||
updated: 2026-07-11
|
||||
updated: 2026-07-13
|
||||
---
|
||||
# MMUD — Mesh Multi-User Dungeon
|
||||
|
||||
|
|
|
|||
|
|
@ -1,15 +1,22 @@
|
|||
---
|
||||
title: "Nominatim v5 Re-import"
|
||||
title: Nominatim v5 Re-import
|
||||
type: project
|
||||
tags: [recon, storage]
|
||||
related: []
|
||||
tags:
|
||||
- recon
|
||||
aliases: []
|
||||
related:
|
||||
- [[navi]]
|
||||
- [[fleet-platform-baseline]]
|
||||
- [[fleet-patch-audit]]
|
||||
- [[recon-operations]]
|
||||
- [[themes]]
|
||||
updated: 2026-07-13
|
||||
status: complete
|
||||
updated: 2026-06-23
|
||||
---
|
||||
|
||||
# Nominatim v5 Re-import
|
||||
|
||||
Spun off from the [[fleet-patch-audit]] (2026-06-19). Completed 2026-06-23 as a standalone maintenance window.
|
||||
Spun off from the [[fleet-patch-audit]] ([[2026-06-19]]). Completed 2026-06-23 as a standalone maintenance window.
|
||||
|
||||
## Deployed 2026-06-23
|
||||
|
||||
|
|
@ -45,7 +52,7 @@ The prior v4.5 container, its ~26 GB DB, and the `mediagis/nominatim:4.5` image
|
|||
|
||||
### Coverage clarification
|
||||
|
||||
The v4.5 deployment was also western-11 only — this was not always clearly documented. The v5 upgrade was a like-for-like data freshness + engine refresh, not a coverage expansion.
|
||||
The v4.5 [[deployment]] was also western-11 only — this was not always clearly documented. The v5 upgrade was a like-for-like data freshness + engine refresh, not a coverage expansion.
|
||||
|
||||
### Photon — not coupled this upgrade
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue