fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

2026-05-23: config-to-git deployed, syncstack consolidated, secrets backlog detailed

Browse Source 
- Config-to-git crons live on CT 108/102/PVE; HA pending
- Syncstack retired; litellm_sync.py in MCP gateway loop
- Infisical migration phases 2-4 detailed in backlog

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Florian Krebs
2026-05-23 00:09:59 +02:00
parent 377f20a817
commit 8ccf76b37c
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RESUME.md
+13 -4
View File
@@ -1,6 +1,6 @@
# Session Resume # Session Resume
Last updated: 2026-05-22. Update this at the end of every session. Last updated: 2026-05-23. Update this at the end of every session.
## Open items (urgency order) ## Open items (urgency order)
@@ -19,15 +19,19 @@ Last updated: 2026-05-22. Update this at the end of every session.
### 🟡 Medium — incomplete migrations / cleanup debt ### 🟡 Medium — incomplete migrations / cleanup debt
- [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c. - [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
- [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c. - [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c.
- [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3. - [x] ~~**Config-to-git**~~ — deployed 2026-05-23. Scripts + daily 03:00 crons on CT 108, CT 102, PVE. Pushes to `fkrebs/zoraxy-conf`, `fkrebs/adguard-conf`, `fkrebs/pve-conf` (force-push). HA (`fkrebs/ha-config`) still pending — needs Git Pull addon on HAOS.
- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. - [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22. - [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22.
### 🔵 Planned — requires infrastructure or significant effort ### 🔵 Planned — requires infrastructure or significant effort
- [ ] **CT 109 "ops"** — LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` §16. - [ ] **CT 109 "ops"** — LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` §16.
- [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items. - [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items.
- [ ] **Infisical secrets migration** — CT 112 provisioned; migration not started. Phase 1-4: move 85+ `.env` keys. See `services/secrets-manager.md`. - [ ] **Infisical secrets migration** — CT 112 deployed (`192.168.1.7:8200`, LAN-only). Phase 1 done. Remaining:
- [ ] **Consolidate syncstack → MCP gateway** — move LiteLLM model polling + LobeChat sync into gateway's loop; delete syncstack cron. - **Phase 2**: create project `homelab/ct104`, import `ai/.env` (~55 keys) via `infisical import`, add agent sidecars to compose stacks
- **Phase 3**: replace hardcoded env vars in Coder `main.tf` (committed to Gitea — security risk)
- **Phase 4**: OIDC SSO via Pocket-ID (low priority — convenience)
See `services/secrets-manager.md`.
- [x] ~~**Consolidate syncstack → MCP gateway**~~ — done 2026-05-23. `litellm_sync.py` ported from syncstack, mounted into gateway. Gateway runs `run_sync()` every 15 min (120s startup delay). `/etc/cron.d/syncstack` deleted; `Dockerfile.syncstack` → `.DECOMMISSIONED-2026-05-23`; `/opt/stacks/CLAUDE.md` updated.
- [ ] **ZFS ARC tuning** — raise `zfs_arc_max` from 6.2 GiB → 16 GiB once CT 101 memory right-sized. See `infra/proxmox-state.md` §3. - [ ] **ZFS ARC tuning** — raise `zfs_arc_max` from 6.2 GiB → 16 GiB once CT 101 memory right-sized. See `infra/proxmox-state.md` §3.
- [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`. - [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`.
- [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`. - [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`.
@@ -35,6 +39,11 @@ Last updated: 2026-05-22. Update this at the end of every session.
- [ ] **Arcane → CT 109 migration** — blocked by CT 109. Procedure documented in `services/arcane.md`. - [ ] **Arcane → CT 109 migration** — blocked by CT 109. Procedure documented in `services/arcane.md`.
- [x] ~~**crawl4ai SSE StreamConsumed**~~ — resolved 2026-05-22. Errors were from old code in log history; clean restart confirms no errors. Health: ok (7 tools), lobe-sync: 27/27 servers. - [x] ~~**crawl4ai SSE StreamConsumed**~~ — resolved 2026-05-22. Errors were from old code in log history; clean restart confirms no errors. Health: ok (7 tools), lobe-sync: 27/27 servers.
## Recently completed (2026-05-23)
- **Config-to-git crons**: scripts + daily 03:00 crons deployed on CT 108 (Zoraxy → `zoraxy-conf`), CT 102 (AdGuard → `adguard-conf`), PVE (rsync `/etc/pve` → `pve-conf`). Force-push. All three verified with initial push.
- **Syncstack → MCP gateway**: `litellm_sync.py` (ported from syncstack.py) mounted into gateway container. `_litellm_sync_loop()` runs every 15 min in gateway's asyncio loop. Cron `/etc/cron.d/syncstack` deleted. `Dockerfile.syncstack` decommissioned. `/opt/stacks/CLAUDE.md` updated.
## Recently completed (session continued ×2, 2026-05-22) ## Recently completed (session continued ×2, 2026-05-22)
- **crawl4ai MCP fixed**: was returning 404 on `/mcp` (streamable-HTTP). Current 0.8.6 image already has MCP over SSE at `/mcp/sse`. Added SSE transport support to `mcp-gateway/server.py`: per-request SSE round-trip with auto-initialize handshake; `transport: sse` in hardcoded SERVERS + config.json. Gateway health now shows crawl4ai ok; lobe-sync shows 27/27 servers. - **crawl4ai MCP fixed**: was returning 404 on `/mcp` (streamable-HTTP). Current 0.8.6 image already has MCP over SSE at `/mcp/sse`. Added SSE transport support to `mcp-gateway/server.py`: per-request SSE round-trip with auto-initialize handshake; `transport: sse` in hardcoded SERVERS + config.json. Gateway health now shows crawl4ai ok; lobe-sync shows 27/27 servers.