From 8ccf76b37cf6f5fac6b2df50077cd6bb10d349ee Mon Sep 17 00:00:00 2001
From: "fkrebs (via Claude)" <fkrebs@nucli.de>
Date: Sat, 23 May 2026 00:09:59 +0200
Subject: [PATCH] 2026-05-23: config-to-git deployed, syncstack consolidated,
 secrets backlog detailed

- Config-to-git crons live on CT 108/102/PVE; HA pending
- Syncstack retired; litellm_sync.py in MCP gateway loop
- Infisical migration phases 2-4 detailed in backlog

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 RESUME.md | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/RESUME.md b/RESUME.md
index 77693d2..7e61a00 100644
--- a/RESUME.md
+++ b/RESUME.md
@@ -1,6 +1,6 @@
 # Session Resume
 
-Last updated: 2026-05-22. Update this at the end of every session.
+Last updated: 2026-05-23. Update this at the end of every session.
 
 ## Open items (urgency order)
 
@@ -19,15 +19,19 @@ Last updated: 2026-05-22. Update this at the end of every session.
 ### 🟡 Medium — incomplete migrations / cleanup debt
 - [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
 - [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c.
-- [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3.
+- [x] ~~**Config-to-git**~~ — deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. Pushes to `fkrebs/zoraxy-conf`, `fkrebs/adguard-conf`, `fkrebs/pve-conf` (force-push). HA (`fkrebs/ha-config`) still pending — needs Git Pull addon on HAOS.
 - [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
 - [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22.
 
 ### 🔵 Planned — requires infrastructure or significant effort
 - [ ] **CT 109 "ops"** — LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` §16.
 - [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items.
-- [ ] **Infisical secrets migration** — CT 112 provisioned; migration not started. Phase 1-4: move 85+ `.env` keys. See `services/secrets-manager.md`.
-- [ ] **Consolidate syncstack → MCP gateway** — move LiteLLM model polling + LobeChat sync into gateway's loop; delete syncstack cron.
+- [ ] **Infisical secrets migration** — CT 112 deployed (`192.168.1.7:8200`, LAN-only). Phase 1 done. Remaining:
+  - **Phase 2**: create project `homelab/ct104`, import `ai/.env` (~55 keys) via `infisical import`, add agent sidecars to compose stacks
+  - **Phase 3**: replace hardcoded env vars in Coder `main.tf` (committed to Gitea — security risk)
+  - **Phase 4**: OIDC SSO via Pocket-ID (low priority — convenience)
+  See `services/secrets-manager.md`.
+- [x] ~~**Consolidate syncstack → MCP gateway**~~ — done 2026-05-23. `litellm_sync.py` ported from syncstack, mounted into gateway. Gateway runs `run_sync()` every 15 min (120s startup delay). `/etc/cron.d/syncstack` deleted; `Dockerfile.syncstack` → `.DECOMMISSIONED-2026-05-23`; `/opt/stacks/CLAUDE.md` updated.
 - [ ] **ZFS ARC tuning** — raise `zfs_arc_max` from 6.2 GiB → 16 GiB once CT 101 memory right-sized. See `infra/proxmox-state.md` §3.
 - [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`.
 - [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`.
@@ -35,6 +39,11 @@ Last updated: 2026-05-22. Update this at the end of every session.
 - [ ] **Arcane → CT 109 migration** — blocked by CT 109. Procedure documented in `services/arcane.md`.
 - [x] ~~**crawl4ai SSE StreamConsumed**~~ — resolved 2026-05-22. Errors were from old code in log history; clean restart confirms no errors. Health: ok (7 tools), lobe-sync: 27/27 servers.
 
+## Recently completed (2026-05-23)
+
+- **Config-to-git crons**: scripts + daily 03:00 crons deployed on CT 108 (Zoraxy → `zoraxy-conf`), CT 102 (AdGuard → `adguard-conf`), PVE (rsync `/etc/pve` → `pve-conf`). Force-push. All three verified with initial push.
+- **Syncstack → MCP gateway**: `litellm_sync.py` (ported from syncstack.py) mounted into gateway container. `_litellm_sync_loop()` runs every 15 min in gateway's asyncio loop. Cron `/etc/cron.d/syncstack` deleted. `Dockerfile.syncstack` decommissioned. `/opt/stacks/CLAUDE.md` updated.
+
 ## Recently completed (session continued ×2, 2026-05-22)
 
 - **crawl4ai MCP fixed**: was returning 404 on `/mcp` (streamable-HTTP). Current 0.8.6 image already has MCP over SSE at `/mcp/sse`. Added SSE transport support to `mcp-gateway/server.py`: per-request SSE round-trip with auto-initialize handshake; `transport: sse` in hardcoded SERVERS + config.json. Gateway health now shows crawl4ai ok; lobe-sync shows 27/27 servers.