Changelog

All notable infrastructure / service / doc changes. Newest first.

2026-05-20

Pocket-ID migrated CT 104 → CT 110 "id" (192.168.1.5:11000). Authoritative writes now on CT 110; old data dir on CT 104 is a stale snapshot. Compose on CT 104 renamed .MIGRATED-TO-CT110-2026-05-20. Zoraxy upstream for id.nuclide.systems flipped.
Pocket-ID 2.7.0 uses bcrypt for OIDC client secrets — previously some clients (Gitea, Coder) had raw 64-char SHA-256 hex in oidc_clients.secret, which silently failed every token exchange. Regenerated both with proper bcrypt hashes; audit also surfaced an orphaned Daytona client and the empty-secret vscode row.
Gitea SSO via Pocket-ID wired with bcrypt fix + correct Scopes (openid,profile,email) + two_factor_policy=skip + ACCOUNT_LINKING=auto + ENABLE_AUTO_REGISTRATION=true + USERNAME=preferred_username. Local password sign-in form disabled (GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM=false); legacy OpenID 2.0 button hidden (GITEA__openid__ENABLE_OPENID_SIGNIN=false).
Coder SSO via Pocket-ID wired. User row flipped login_type=password → oidc. CODER_DISABLE_PASSWORD_AUTH=true + CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE=false. Workspace-side GitHub external_auth left on (for repo cloning).

New LXC stood up with Coder + Gitea + their Postgres companions.
Templates pushed to Coder: python-uv (persistent, GPU, code-server, baked LiteLLM + Anthropic env, Claude Code auto-install) and mcp-sandbox (ephemeral, sci stack pre-baked).
GPU passthrough confirmed: /dev/dri/by-path/pci-0000:00:02.0-render exposed; CT 111-level symlink at /dev/dri/renderD128 (systemd-tmpfiles) so the Docker provider's path parser is happy.
dotfiles repo created at fkrebs/dotfiles on Gitea — oh-my-zsh, LiteLLM model picker (models.env), docker alias set, ~/.claude/settings.json permissions allowlist, global Python CLAUDE.md, .gitignore_global, VSCodium settings + extensions.txt.
mkproj helper appends [tool.coder] workspace+owner block to new pyproject.toml, copies pre-commit config + .gitignore, installs dev deps, initial commit.

Zoraxy WebSocket forwarding enabled for dev., git., mcp.nuclide.systems (EnableWebsocketCustomHeaders=true + HeaderRewriteRules.DisableHopByHopHeaderRemoval=true). Coder agent / Gitea live updates / streamable-MCP all need this. Backups at /tmp/zoraxy-backup-2026-05-20/ on CT 108.

daytona removed, coder added in /opt/stacks/ai/mcp-gateway/config.json. The morning-briefing scheduled agent's server list updated. Built a small coder-mcp image (multi-stage from ghcr.io/coder/coder:latest + uv:bookworm-slim + uv tool install mcp-proxy) that coder logins once then runs coder exp mcp server behind streamable-HTTP.
Coder MCP exposes tools coder_create_task + workspace lifecycle from Coder Agent v1.27.1.

Daytona (/opt/stacks/daytona/ + /opt/stacks/ai/daytona-mcp.yml on CT 104) — containers stopped + removed; compose files renamed .DECOMMISSIONED-2026-05-20. Coder replaces it.

/CLAUDE.md created on host — operator doctrine for any agent SSHing in: keep things running, enforce consistency, plan rollback at medium-risk+, services AI-accessible by default, test before declaring done, generate slash commands for recurring tasks, inventory skills/commands/MCPs at session start.
/docs is now a git repo, baseline at 04d54ac.
Doc reorg into infra/ services/ history/ ideas/. Traefik guides moved to history/ (Zoraxy is permanent). mcp-gateway-requirements.md and scrubbing-list-2026-05-17.md also archived.

Garage moved off NFS-on-UNAS to local zfs on CT 104 (/opt/stacks/shared-db/garage/{meta,data}) after a WAL-G outage. Tier-1 (SQLite) databases off NFS as a follow-up; UNAS reserved for bulk media + workspace home dirs.
n8n reverted to local SQLite after a Postgres migration attempt failed.

MCP gateway design frozen. Implementation in services/mcp-gateway.md; design rationale archived as history/mcp-gateway-requirements.md.
Per-stack scrubbing pass (see history/scrubbing-list-2026-05-17.md for the inventory at that snapshot).

Traefik abandoned, Zoraxy is the production reverse proxy. Two migration guides preserved in history/ for context only.