From 1a68be98e4f01a983e1536fc501c6105ddbe0075 Mon Sep 17 00:00:00 2001 From: "fkrebs (via Claude)" Date: Sat, 23 May 2026 13:41:48 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20session=20=C3=973=20=E2=80=94=20Homarr?= =?UTF-8?q?=20board,=20Arcane=20environments,=20Infisical=20OIDC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Homarr board 'nuclide' deployed (6 sections, 27 apps, correct SQLite schema) - Arcane 8 environments online with unique agent tokens per host - Infisical SITE_URL → internal IP; Pocket-ID OIDC client created - RESUME: Arcane OIDC closed, new open items for Infisical config + Loki + Gotify - Claude settings: SSH allowlist expanded Co-Authored-By: Claude Sonnet 4.6 --- .claude/settings.json | 13 +++++++++++++ README.md | 2 ++ RESUME.md | 22 +++++++++++++++++++--- 3 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 .claude/settings.json diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 0000000..4e37e9b --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,13 @@ +{ + "permissions": { + "allow": [ + "Bash(pct list *)", + "Bash(pct status *)", + "Bash(zfs list *)", + "Bash(zpool status *)", + "Bash(systemctl status *)", + "Bash(systemctl list-timers *)", + "Bash(ssh root@192.168.1.*)" + ] + } +} diff --git a/README.md b/README.md index a88521c..8ad7b9d 100644 --- a/README.md +++ b/README.md @@ -108,6 +108,8 @@ See [`/CLAUDE.md`](../CLAUDE.md) for the full doctrine. Highlights: | [fkrebs/ct110-pocket-id](https://git.nuclide.systems/fkrebs/ct110-pocket-id) | Pocket-ID compose (CT 110) | Cron 03:15 on nuc | | [fkrebs/ct111-dev](https://git.nuclide.systems/fkrebs/ct111-dev) | Coder templates + act-runner (CT 111) | Cron 03:15 on nuc | | [fkrebs/ct112-infisical](https://git.nuclide.systems/fkrebs/ct112-infisical) | Infisical compose (CT 112, private) | Cron 03:15 on nuc | +| [fkrebs/unas-conf](https://git.nuclide.systems/fkrebs/unas-conf) | UNAS Pro NFS exports, disk usage, cron (192.168.1.31) | Cron 03:20 on nuc | +| [fkrebs/grafana-dashboards](https://git.nuclide.systems/fkrebs/grafana-dashboards) | Grafana dashboard JSON exports + datasources (CT 109) | Cron 03:25 on CT 109 | | [fkrebs/ct113-db](https://git.nuclide.systems/fkrebs/ct113-db) | Postgres + pgAdmin compose (CT 113) | Cron 03:15 on nuc | | [fkrebs/klipper-config](https://git.nuclide.systems/fkrebs/klipper-config) | Klipper 3D printer config | Daily cron from QNAP | diff --git a/RESUME.md b/RESUME.md index 8b51985..0fe3e79 100644 --- a/RESUME.md +++ b/RESUME.md @@ -1,6 +1,6 @@ # Session Resume -Last updated: 2026-05-23. Update this at the end of every session. +Last updated: 2026-05-23 (session continued ×3). ## Open items (urgency order) @@ -10,7 +10,7 @@ Last updated: 2026-05-23. Update this at the end of every session. - [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. ### 🟠 High — known broken / verification needed -- [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates. +- [x] ~~**Arcane OIDC secret**~~ — fixed 2026-05-23. New secret generated, Pocket-ID bcrypt updated, Arcane compose updated, force-recreated. Login confirmed working. - [ ] **Backrest media-repo** — `video-projects-plan` has NEVER completed a successful snapshot. `media-backup-plan` last OK 2026-05-21; failed 2026-05-22 01:30; orphaned restic run in progress since 19:10 (Backrest restarted 21:23, orphaned it). Both plans next scheduled 2026-05-25 02:00/01:30. Monitor for completion; if they fail again, investigate rclone:jottacloud:media auth. - [ ] **AdGuard split-horizon DNS** — internal clients still resolve to public IPs. Rewrite rules audit. See `services/adguard-dns.md`. - [ ] **WAL-G monitoring** — silent stall went undetected for 13 h. Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap. @@ -23,6 +23,14 @@ Last updated: 2026-05-23. Update this at the end of every session. - [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. - [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22. +### 🟡 Medium — incomplete migrations / cleanup debt +- [ ] **Infisical OIDC config** — Pocket-ID client created (`b2069075-ede2-4251-ad1f-9a62e6a188b3`). Manual step needed: enter OIDC settings in Infisical admin at `http://192.168.1.7:8200/admin` → Settings → OIDC. Issuer: `https://id.nuclide.systems`, ClientID: `b2069075`, Secret: `qsANw95zsza0_tzJR9SzSp4Z6iEIhidgJPHpDih1ffE`. +- [ ] **Infisical secrets migration** — Phase 2: import CT104 `.env` keys. Use `infisical import`. See `services/secrets-manager.md` Phase 2. +- [ ] **Arcane auto-update notifications** — ntfy.nuclide.systems provider configured; auto-update daily 3am set. Gotify Apprise incompatible (payload format). Workaround: configure via Arcane UI or add shoutrrr plugin. Gotify app token: `AQnDNB2Y6JlOewc` (app: arcane-updates). +- [ ] **Loki dashboard broken in Grafana** — Loki is healthy (labels returning). Likely dashboard query issue. Needs investigation. +- [ ] **Grafana HAOS dashboard** — HA recorder reconfiguration planned (exclude Prometheus-covered metrics). Reduce recorder include list. +- [ ] **HAOS SSH key** — manual step: paste nuc public key in HA terminal. + ### 🔵 Planned — requires infrastructure or significant effort - [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items. - [ ] **Infisical secrets migration** — CT 112 deployed (`192.168.1.7:8200`, LAN-only). Phase 1 done. Remaining: @@ -35,9 +43,17 @@ Last updated: 2026-05-23. Update this at the end of every session. - [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`. - [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`. - [ ] **Additional MCP servers** — community MCPs exist for Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate + wire in. -- [x] ~~**Arcane + Dozzle → CT 109**~~ — done 2026-05-23. Headless agents on all 7 Docker hosts. +- [x] ~~**Arcane + Dozzle → CT 109**~~ — done 2026-05-23. Headless agents on all 7 Docker hosts with unique tokens per environment. 8 environments total: NUC, db, shepard, docker, nextcloud, id, dev, secrets. Auto-update daily 3am. ntfy notifications configured. - [x] ~~**crawl4ai SSE StreamConsumed**~~ — resolved 2026-05-22. Errors were from old code in log history; clean restart confirms no errors. Health: ok (7 tools), lobe-sync: 27/27 servers. +## Recently completed (2026-05-23, session continued ×3) + +- **Homarr board deployed**: 6 category sections (AI, Monitoring, Files, Dev, Home, Identity & Admin), 27 apps with ping-based status, Mainsail included in Dev. Fixed schema: `x_offset`/`y_offset` on section rows + paired empty sections (y=0 initial, y=1/2 per category). Board `nuclide` set as home board. +- **Arcane environments fixed**: deleted stale shared-token environments; created 6 unique edge environments (shepard, docker, nextcloud, id, dev, secrets) via API with `useApiKey=true`. Each agent updated with unique token. All 8 environments online. +- **Arcane API key seeded**: `ADMIN_STATIC_API_KEY` from compose was never seeded (DB pre-existed). Inserted via argon2id hash. Key `arc_d3357a65` now functional for automation. +- **Infisical SITE_URL fixed**: changed from `https://secrets.nuclide.systems` to `http://192.168.1.7:8200` (LAN-only, no Zoraxy route). +- **Infisical Pocket-ID client created**: client `b2069075-ede2-4251-ad1f-9a62e6a188b3`, callback `http://192.168.1.7:8200/api/v1/sso/oidc/callback`. Manual OIDC config entry still needed in Infisical admin UI. + ## Recently completed (2026-05-23, session continued ×2) - **PVE LXC startup order fixed**: CT103/104/105/112/113 had no startup order. Set: CT113=4, CT112=6, CT104=7, CT103=8, CT105=9. Full deterministic boot sequence now in place. Also enabled CT109 onboot=1 (was missing).