fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
52db8ce9edd2916863563a5c5da2a9a6a1901071
docs/CHANGELOG.md
T
fkrebs ad0fdd2beb docs: dissolve Stacks chapter → infra/; reconcile portmap, storage, changelog (2026-05-21) 
- Move PORTMAP, storage, volumes, docker-networks from stacks/ → infra/
- Remove stacks/todo.md (content migrated to CHANGELOG + ideas)
- portmap: add new MCP servers (18005/07/09/10/11), fix s3.nuclide.systems entry,
  update Daytona OIDC row to DECOMMISSIONED, add Vaultwarden OIDC placeholder,
  add DevOps table row for MCP server Gitea repos
- storage: add Garage S3 buckets subsection (lobe-files + chat-artifacts)
- docker-networks: remove daytona-minimal_daytona-network row + daytona from
  "Stacks Keeping Own Networks" list
- ct-inventory: add CT 112 (secrets/Infisical, planned)
- CHANGELOG: prepend 2026-05-21 entry (docs, S3, MCP, dev env, Gitea repos, planned)
- ideas/stack-ideas: add §11 Renovate Bot, §12 egress firewall, §13 local LLM
- mkdocs.yml: replace nav — dissolve Stacks chapter, add infra/ entries
2026-05-21 07:54:21 +02:00

6.9 KiB
Raw Blame History

Changelog

All notable infrastructure / service / doc changes. Newest first.

2026-05-21

Docs & docs infrastructure

  • Mermaid diagrams now rendering in mkdocs Material site — was missing custom_fences config in pymdownx.superfences. Fixed in docs-server/mkdocs.yml and rebuilt container.
  • site_url corrected to http://192.168.1.111:13080 (docs are LAN-only; no Zoraxy route exists).
  • Docs restructured: "Stacks (CT 104)" chapter dissolved; PORTMAP, Storage, Volumes, Docker networks moved to infra/ section. TODO items migrated into CHANGELOG + ideas.
  • Secrets manager design doc added at services/secrets-manager.md — recommends Infisical on a new CT 112.

Storage / S3

  • s3.nuclide.systems Zoraxy route fixed — EnableWebsocketCustomHeaders, DisableHopByHopHeaderRemoval, EnableAutoHTTPS all set. Garage S3 API now reachable externally.
  • chat-artifacts Garage S3 bucket created — public-read via https://chat-artifacts.s3.nuclide.systems/<key>. Credentials at /root/garage-chat-artifacts.creds (not git-tracked).

MCP surface

  • upload-artifact MCP server deployed (port 18011, CT 104). Tools: upload_text, upload_base64, list_artifacts, get_url, delete_artifact. Registered in gateway (now 24 servers). Source: git.nuclide.systems/fkrebs/mcp-upload-artifact.
  • ComfyUI MCP now auto-uploads completed images to chat-artifacts S3 and includes the public URL alongside the inline base64 image.
  • DAYTONA_API_KEY removed from CT 104 ai/.env (Daytona decommissioned 2026-05-20).

Dev environment

  • savefig dotfiles helper added to fkrebs/dotfiles — uploads any file to chat-artifacts using uv run --with boto3; reads credentials from env vars.
  • Coder python-uv template updated with CHAT_ARTIFACTS_* env vars baked in; template pushed to Coder server.

Gitea repos

  • New repos created: mcp-comfyui, mcp-docling, mcp-shepard, mcp-upload-artifact, home-assistant-config — all at git.nuclide.systems/fkrebs/.
  • HAOS config (192.168.1.60, VM 100) has a Gitea upstream ready. Manual push needed from HA terminal (see services/secrets-manager.md for SSH access notes).

Planned

  • CT 112 "secrets" — Infisical deployment (see services/secrets-manager.md)
  • Renovate Bot via Gitea Actions — dependency updates for MCP server repos (Dockerfiles + requirements.txt)
  • Vaultwarden OIDC SSO wiring (client created in Pocket-ID 2026-05-21; auth flow not yet configured)
  • LobeHub Artifacts → S3 patch (TypeScript, ~3-4h, deferred)

2026-05-20

Auth / Identity (single sign-on lockdown)

  • Pocket-ID migrated CT 104 → CT 110 "id" (192.168.1.5:11000). Authoritative writes now on CT 110; old data dir on CT 104 is a stale snapshot. Compose on CT 104 renamed .MIGRATED-TO-CT110-2026-05-20. Zoraxy upstream for id.nuclide.systems flipped.
  • Pocket-ID 2.7.0 uses bcrypt for OIDC client secrets — previously some clients (Gitea, Coder) had raw 64-char SHA-256 hex in oidc_clients.secret, which silently failed every token exchange. Regenerated both with proper bcrypt hashes; audit also surfaced an orphaned Daytona client and the empty-secret vscode row.
  • Gitea SSO via Pocket-ID wired with bcrypt fix + correct Scopes (openid,profile,email) + two_factor_policy=skip + ACCOUNT_LINKING=auto + ENABLE_AUTO_REGISTRATION=true + USERNAME=preferred_username. Local password sign-in form disabled (GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM=false); legacy OpenID 2.0 button hidden (GITEA__openid__ENABLE_OPENID_SIGNIN=false).
  • Coder SSO via Pocket-ID wired. User row flipped login_type=password → oidc. CODER_DISABLE_PASSWORD_AUTH=true + CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE=false. Workspace-side GitHub external_auth left on (for repo cloning).

Dev environment (new CT 111 "dev", 192.168.1.42)

  • New LXC stood up with Coder + Gitea + their Postgres companions.
  • Templates pushed to Coder: python-uv (persistent, GPU, code-server, baked LiteLLM + Anthropic env, Claude Code auto-install) and mcp-sandbox (ephemeral, sci stack pre-baked).
  • GPU passthrough confirmed: /dev/dri/by-path/pci-0000:00:02.0-render exposed; CT 111-level symlink at /dev/dri/renderD128 (systemd-tmpfiles) so the Docker provider's path parser is happy.
  • dotfiles repo created at fkrebs/dotfiles on Gitea — oh-my-zsh, LiteLLM model picker (models.env), docker alias set, ~/.claude/settings.json permissions allowlist, global Python CLAUDE.md, .gitignore_global, VSCodium settings + extensions.txt.
  • mkproj helper appends [tool.coder] workspace+owner block to new pyproject.toml, copies pre-commit config + .gitignore, installs dev deps, initial commit.

Reverse proxy

  • Zoraxy WebSocket forwarding enabled for dev., git., mcp.nuclide.systems (EnableWebsocketCustomHeaders=true + HeaderRewriteRules.DisableHopByHopHeaderRemoval=true). Coder agent / Gitea live updates / streamable-MCP all need this. Backups at /tmp/zoraxy-backup-2026-05-20/ on CT 108.

MCP gateway

  • daytona removed, coder added in /opt/stacks/ai/mcp-gateway/config.json. The morning-briefing scheduled agent's server list updated. Built a small coder-mcp image (multi-stage from ghcr.io/coder/coder:latest + uv:bookworm-slim + uv tool install mcp-proxy) that coder logins once then runs coder exp mcp server behind streamable-HTTP.
  • Coder MCP exposes tools coder_create_task + workspace lifecycle from Coder Agent v1.27.1.

Decommissions

  • Daytona (/opt/stacks/daytona/ + /opt/stacks/ai/daytona-mcp.yml on CT 104) — containers stopped + removed; compose files renamed .DECOMMISSIONED-2026-05-20. Coder replaces it.

Docs / governance

  • /CLAUDE.md created on host — operator doctrine for any agent SSHing in: keep things running, enforce consistency, plan rollback at medium-risk+, services AI-accessible by default, test before declaring done, generate slash commands for recurring tasks, inventory skills/commands/MCPs at session start.
  • /docs is now a git repo, baseline at 04d54ac.
  • Doc reorg into infra/ services/ history/ ideas/. Traefik guides moved to history/ (Zoraxy is permanent). mcp-gateway-requirements.md and scrubbing-list-2026-05-17.md also archived.

2026-05-19

  • Garage moved off NFS-on-UNAS to local zfs on CT 104 (/opt/stacks/shared-db/garage/{meta,data}) after a WAL-G outage. Tier-1 (SQLite) databases off NFS as a follow-up; UNAS reserved for bulk media + workspace home dirs.
  • n8n reverted to local SQLite after a Postgres migration attempt failed.

2026-05-17

  • MCP gateway design frozen. Implementation in services/mcp-gateway.md; design rationale archived as history/mcp-gateway-requirements.md.
  • Per-stack scrubbing pass (see history/scrubbing-list-2026-05-17.md for the inventory at that snapshot).

2026-05-16

  • Traefik abandoned, Zoraxy is the production reverse proxy. Two migration guides preserved in history/ for context only.
Reference in New Issue View Git Blame Copy Permalink