ef8b1e0bd9
Files changed: engine/.embcache.json engine/changelog.md engine/lint-report.md vault/.trash/2026-06-19.md vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/matrix/archivist.md vault/docs/matrix/matrix_host.md vault/docs/matrix/mautrix_signal.md vault/docs/matrix/synapse.md vault/docs/matrix/synapse_retention_discovery.md vault/docs/navi/cc-rules.md vault/docs/navi/deployment.md vault/docs/navi/themes.md vault/docs/services/ots-setup.md vault/docs/services/services.md vault/docs/services/usenet.md vault/docs/software/authentik.md vault/docs/software/caddy.md vault/docs/software/central.md vault/docs/software/dns.md vault/docs/software/geo-tools.md vault/docs/software/navi.md vault/docs/software/recon.md vault/docs/software/searxng.md vault/glossary.md vault/notes/echo6-landing-page-data-export.md vault/notes/ia-download-queue.md vault/projects/advbbs-project.md vault/projects/argus.md vault/projects/deploy-livesync.md vault/projects/fleet-patch-audit.md vault/projects/fleet-platform-baseline.md vault/projects/matrix-synapse-deployment.md vault/projects/meshai-config-hot-apply.md vault/projects/meshai-region-routing-plan.md vault/projects/meshai.md vault/projects/meshcore-transport.md vault/projects/meshtastic-headscale-runbook.md vault/projects/mmud-project.md vault/projects/nominatim-v5-reimport.md vault/runbooks/add-peertube-channel.md vault/runbooks/authentik-access-groups.md vault/runbooks/authentik-create-invitation.md vault/runbooks/authentik-oidc-application.md vault/runbooks/authentik-upgrade.md vault/runbooks/central-deploy-cutover.md vault/runbooks/ct-runbook.md vault/runbooks/edge2-access-reference.md vault/runbooks/expose-service-contabo.md vault/runbooks/expose-service-edge2.md vault/runbooks/expose-service-home.md vault/runbooks/fleet-magicdns-resolved-migration.md vault/runbooks/headless-browser-page-verification.md vault/runbooks/headscale-oidc-boot-order.md vault/runbooks/headscale-onboard-node.md vault/runbooks/ia-cli-reference.md vault/runbooks/ia-download-mirror.md vault/runbooks/idahomesh-bridge-setup.md vault/runbooks/idahomesh-vpn-device-setup.md vault/runbooks/lxc-service-migration.md vault/runbooks/mailcow-create-mailbox.md vault/runbooks/meshai-prod-compose-override.md vault/runbooks/meshmonitor-password-reset.md vault/runbooks/meshtastic-sidecar-node.md vault/runbooks/meshtasticd-sim-nodes-runbook.md vault/runbooks/nordvpn-lxc.md vault/runbooks/peertube-remote-runner.md vault/runbooks/pg-backup.md vault/runbooks/pi-nas-omv-runbook.md vault/runbooks/pipeline-patterns.md vault/runbooks/proxmox-create-ubuntu-vm.md vault/runbooks/proxmox-onboard-node.md vault/runbooks/pymc-repeater-kiss-tnc-reenumeration.md vault/runbooks/recon-operations.md vault/runbooks/recon-service-integration.md vault/runbooks/syncthing-add-node.md vault/runbooks/toc-cortex-pve9.2-update.md vault/session-resume/SESSION-HANDOFF-meshai-test.md
80 lines
3.8 KiB
Markdown
80 lines
3.8 KiB
Markdown
---
|
|
title: Fleet Platform Baseline — post-patch 2026-06-22
|
|
type: project
|
|
tags:
|
|
- proxmox
|
|
aliases: []
|
|
related:
|
|
- [[fleet-patch-audit]]
|
|
- [[environment]]
|
|
- [[toc-cortex-pve9.2-update]]
|
|
- [[central]]
|
|
- [[ip-allocation]]
|
|
updated: 2026-07-13
|
|
status: current
|
|
---
|
|
|
|
# Fleet Platform Baseline — post-patch 2026-06-22
|
|
|
|
Point-in-time platform state after the [[2026-06-19]]/22 patch campaign. Full campaign record and accepted caveats in [[fleet-patch-audit]].
|
|
|
|
---
|
|
|
|
## Proxmox cluster (`echo6-cluster`)
|
|
|
|
5 nodes, quorum 3/5, no HA configured.
|
|
|
|
| Node | Platform |
|
|
|---|---|
|
|
| data, utility, cloud, media, toc | PVE 9.2.3 / kernel 7.0.12-1-pve (QEMU 11, LXC 7) |
|
|
|
|
All 5 nodes on `pve-no-subscription` (trixie). data, cloud, and media had the repo added during the campaign (utility and toc already had it). LXC containers share the host kernel (7.0); VM guests carry their own Ubuntu kernels.
|
|
|
|
---
|
|
|
|
## Other hosts
|
|
|
|
**pi-nas**
|
|
OMV 8.4.0-3 / kernel 6.18.34+rpt-rpi-2712 (arm64, Raspberry Pi 4). `rpi-eeprom` held (SPI bootloader, intentionally untouched). RAID1 2.8 TB NFS backend serving `/export/{arr,immich,nextcloud,peertube,data}`. Retained artifact: `/root/boot-backup-pre6.18-20260622.tar.gz` (kernel rollback). Durable mailcow backup also on pi-nas (`…/contabo-prewipe-2026-06/mailcow/`, sha256-verified).
|
|
|
|
**cortex (VM150 on toc, GPU)**
|
|
Ubuntu 24.04. NVIDIA driver 580.167.08, nvidia-container-toolkit 1.19.1. AI stack: Ollama 0.30.10 (vault-tagger, GPU), TEI 1.9 / bge-m3 (embeddings, GPU), Qdrant 1.18.2, Open-WebUI 0.9.6. These power the `.ref` vault engine. See [[toc-cortex-pve9.2-update]] for the toc+cortex upgrade procedure.
|
|
|
|
**recon-vm (VM1130 on data)**
|
|
Ubuntu 24.04 (security-patched). PostgreSQL 16, Valhalla, Nominatim 4.5 (v5 deferred — see [[nominatim-v5-reimport]]), Photon, Kiwix.
|
|
|
|
---
|
|
|
|
## Key application versions (as of 2026-06-22)
|
|
|
|
| App | Host | Version | Notes |
|
|
|---|---|---|---|
|
|
| [[authentik]] | edge2 CT105 | 2026.5.3 | Fleet SSO |
|
|
| Forgejo | edge2 CT103 | 15.0.3 | — |
|
|
| Headscale | edge2 CT107 | 0.29.1 | Fleet tailnet coordinator at `vpn.echo6.co`; boot-survival fixed (ports bound to 10.10.10.25, not tailscale IP) |
|
|
| Headscale (IdahoMesh) | utility CT106 | 0.29.1 | Separate IdahoMesh mesh at `vpn.idahomesh.com` |
|
|
| Nextcloud | cloud CT121 | 33.0.5 | AIO; data on pi-nas NFS |
|
|
| Immich | cloud CT120 | 2.7.5 | Photos on pi-nas NFS |
|
|
| PeerTube | media CT110 | 8.2.1 | — |
|
|
| OpenTAKServer | utility CT109 | 1.7.12 | RabbitMQ stays 3.12 by decision; MediaMTX 1.19.1; Mumble 1.5.517 |
|
|
| Matrix/[[synapse]] | edge2 CT106 | 1.155.0 | — |
|
|
| Vaultwarden | edge2 CT102 | 1.36.0 | — |
|
|
| PDM | edge2 CT100 | 1.1.4 | — |
|
|
| CouchDB/LiveSync | edge2 CT104 | 3.5.2 | — |
|
|
| Jellyfin | media VM105 | 10.11.11 | — |
|
|
| Sonarr | media VM105 | 4.0.17 | — |
|
|
| Radarr | media VM105 | 6.2.1 | — |
|
|
| Prowlarr | media VM105 | 2.4.0 | — |
|
|
| SABnzbd | media VM105 | 5.0.4 | — |
|
|
| Navidrome | media VM105 | 0.62.0 | — |
|
|
| Lidarr | media VM105 | v2 | Image-capped — lidarr-on-steroids maintainer has not shipped v3 |
|
|
| Jellyseerr | media VM105 | preview-OIDC | Kept — stable 3.3.0 lacks OIDC/SSO support |
|
|
|
|
---
|
|
|
|
## Accepted caveats (decisions, not TODOs)
|
|
|
|
- **Guest OS security-only:** LXC containers and VMs received security-pocket apt only (Phase 1 scope). Non-security package drift was not swept. A full `apt full-upgrade` ("Phase 1.5") is an option if ever wanted.
|
|
- **RabbitMQ 3.12 (EOL):** left by decision — OTS does not support 4.x. AMQP/MQTT ports are localhost-bound; low exposure. Revisit if/when OTS officially supports RabbitMQ 4.x.
|
|
- **Nominatim 4.5:** v5 re-import is a separate project; see [[nominatim-v5-reimport]].
|
|
- **Optional cosmetic follow-ups:** navidrome.echo6.co expired cert; MediaMTX deprecated config param names; `rpi-eeprom` held; vestigial utility exit-node route (0.0.0.0/0).
|