docs: session ×3 — Homarr board, Arcane environments, Infisical OIDC

- Homarr board 'nuclide' deployed (6 sections, 27 apps, correct SQLite schema) - Arcane 8 environments online with unique agent tokens per host - Infisical SITE_URL → internal IP; Pocket-ID OIDC client created - RESUME: Arcane OIDC closed, new open items for Infisical config + Loki + Gotify - Claude settings: SSH allowlist expanded Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-23 13:41:48 +02:00
parent f441e8b762
commit 1a68be98e4
3 changed files with 34 additions and 3 deletions
@@ -0,0 +1,13 @@
 {
  "permissions": {
    "allow": [
      "Bash(pct list *)",
      "Bash(pct status *)",
      "Bash(zfs list *)",
      "Bash(zpool status *)",
      "Bash(systemctl status *)",
      "Bash(systemctl list-timers *)",
      "Bash(ssh root@192.168.1.*)"
    ]
  }
 }
@@ -108,6 +108,8 @@ See [`/CLAUDE.md`](../CLAUDE.md) for the full doctrine. Highlights:
 | [fkrebs/ct110-pocket-id](https://git.nuclide.systems/fkrebs/ct110-pocket-id) | Pocket-ID compose (CT 110) | Cron 03:15 on nuc |
 | [fkrebs/ct111-dev](https://git.nuclide.systems/fkrebs/ct111-dev) | Coder templates + act-runner (CT 111) | Cron 03:15 on nuc |
 | [fkrebs/ct112-infisical](https://git.nuclide.systems/fkrebs/ct112-infisical) | Infisical compose (CT 112, private) | Cron 03:15 on nuc |
 | [fkrebs/unas-conf](https://git.nuclide.systems/fkrebs/unas-conf) | UNAS Pro NFS exports, disk usage, cron (192.168.1.31) | Cron 03:20 on nuc |
 | [fkrebs/grafana-dashboards](https://git.nuclide.systems/fkrebs/grafana-dashboards) | Grafana dashboard JSON exports + datasources (CT 109) | Cron 03:25 on CT 109 |
 | [fkrebs/ct113-db](https://git.nuclide.systems/fkrebs/ct113-db) | Postgres + pgAdmin compose (CT 113) | Cron 03:15 on nuc |
 | [fkrebs/klipper-config](https://git.nuclide.systems/fkrebs/klipper-config) | Klipper 3D printer config | Daily cron from QNAP |
@@ -1,6 +1,6 @@
 # Session Resume
-Last updated: 2026-05-23. Update this at the end of every session.
+Last updated: 2026-05-23 (session continued ×3).
 ## Open items (urgency order)
@@ -10,7 +10,7 @@ Last updated: 2026-05-23. Update this at the end of every session.
 - [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b.
 ### 🟠 High — known broken / verification needed
- [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates.
+- [x] ~~**Arcane OIDC secret**~~ — fixed 2026-05-23. New secret generated, Pocket-ID bcrypt updated, Arcane compose updated, force-recreated. Login confirmed working.
 - [ ] **Backrest media-repo** — `video-projects-plan` has NEVER completed a successful snapshot. `media-backup-plan` last OK 2026-05-21; failed 2026-05-22 01:30; orphaned restic run in progress since 19:10 (Backrest restarted 21:23, orphaned it). Both plans next scheduled 2026-05-25 02:00/01:30. Monitor for completion; if they fail again, investigate rclone:jottacloud:media auth.
 - [ ] **AdGuard split-horizon DNS** — internal clients still resolve to public IPs. Rewrite rules audit. See `services/adguard-dns.md`.
 - [ ] **WAL-G monitoring** — silent stall went undetected for 13 h. Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap.
@@ -23,6 +23,14 @@ Last updated: 2026-05-23. Update this at the end of every session.
 - [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
 - [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22.
 ### 🟡 Medium — incomplete migrations / cleanup debt
 - [ ] **Infisical OIDC config** — Pocket-ID client created (`b2069075-ede2-4251-ad1f-9a62e6a188b3`). Manual step needed: enter OIDC settings in Infisical admin at `http://192.168.1.7:8200/admin` → Settings → OIDC. Issuer: `https://id.nuclide.systems`, ClientID: `b2069075`, Secret: `qsANw95zsza0_tzJR9SzSp4Z6iEIhidgJPHpDih1ffE`.
 - [ ] **Infisical secrets migration** — Phase 2: import CT104 `.env` keys. Use `infisical import`. See `services/secrets-manager.md` Phase 2.
 - [ ] **Arcane auto-update notifications** — ntfy.nuclide.systems provider configured; auto-update daily 3am set. Gotify Apprise incompatible (payload format). Workaround: configure via Arcane UI or add shoutrrr plugin. Gotify app token: `AQnDNB2Y6JlOewc` (app: arcane-updates).
 - [ ] **Loki dashboard broken in Grafana** — Loki is healthy (labels returning). Likely dashboard query issue. Needs investigation.
 - [ ] **Grafana HAOS dashboard** — HA recorder reconfiguration planned (exclude Prometheus-covered metrics). Reduce recorder include list.
 - [ ] **HAOS SSH key** — manual step: paste nuc public key in HA terminal.
 ### 🔵 Planned — requires infrastructure or significant effort
 - [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items.
 - [ ] **Infisical secrets migration** — CT 112 deployed (`192.168.1.7:8200`, LAN-only). Phase 1 done. Remaining:
@@ -35,9 +43,17 @@ Last updated: 2026-05-23. Update this at the end of every session.
 - [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`.
 - [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`.
 - [ ] **Additional MCP servers** — community MCPs exist for Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate + wire in.
- [x] ~~**Arcane + Dozzle → CT 109**~~ — done 2026-05-23. Headless agents on all 7 Docker hosts.
+- [x] ~~**Arcane + Dozzle → CT 109**~~ — done 2026-05-23. Headless agents on all 7 Docker hosts with unique tokens per environment. 8 environments total: NUC, db, shepard, docker, nextcloud, id, dev, secrets. Auto-update daily 3am. ntfy notifications configured.
 - [x] ~~**crawl4ai SSE StreamConsumed**~~ — resolved 2026-05-22. Errors were from old code in log history; clean restart confirms no errors. Health: ok (7 tools), lobe-sync: 27/27 servers.
 ## Recently completed (2026-05-23, session continued ×3)
 - **Homarr board deployed**: 6 category sections (AI, Monitoring, Files, Dev, Home, Identity & Admin), 27 apps with ping-based status, Mainsail included in Dev. Fixed schema: `x_offset`/`y_offset` on section rows + paired empty sections (y=0 initial, y=1/2 per category). Board `nuclide` set as home board.
 - **Arcane environments fixed**: deleted stale shared-token environments; created 6 unique edge environments (shepard, docker, nextcloud, id, dev, secrets) via API with `useApiKey=true`. Each agent updated with unique token. All 8 environments online.
 - **Arcane API key seeded**: `ADMIN_STATIC_API_KEY` from compose was never seeded (DB pre-existed). Inserted via argon2id hash. Key `arc_d3357a65` now functional for automation.
 - **Infisical SITE_URL fixed**: changed from `https://secrets.nuclide.systems` to `http://192.168.1.7:8200` (LAN-only, no Zoraxy route).
 - **Infisical Pocket-ID client created**: client `b2069075-ede2-4251-ad1f-9a62e6a188b3`, callback `http://192.168.1.7:8200/api/v1/sso/oidc/callback`. Manual OIDC config entry still needed in Infisical admin UI.
 ## Recently completed (2026-05-23, session continued ×2)
 - **PVE LXC startup order fixed**: CT103/104/105/112/113 had no startup order. Set: CT113=4, CT112=6, CT104=7, CT103=8, CT105=9. Full deterministic boot sequence now in place. Also enabled CT109 onboot=1 (was missing).