feat(rag): hybrid FTS+vector retrieval and multi-format ingestion — name-your-tool questions find the right document

tests/fixtures/docs/.hidden/junk.md

@@ -0,0 +1,5 @@
+# Vendored Junk
+
+This file lives under a dot-prefixed directory and must **never** be
+imported into the knowledge base (A9 hidden-dir skip). It exists so the
+retrieval-quality E2E can prove the filter works.

tests/fixtures/docs/homelab/container_gitlab/gitlab-compose.yaml

@@ -0,0 +1,24 @@
+# gitlab stack — single container + gitlab-data volume
+services:
+  gitlab:
+    image: gitlab/gitlab-ce:17.2.1-ce.0
+    container_name: gitlab
+    restart: unless-stopped
+    hostname: "gitlab.reeseapps.com"
+    environment:
+      GITLAB_OMNIBUS_CONFIG: |
+        external_url 'https://gitlab.reeseapps.com'
+        gitlab_rails['gitlab_shell_ssh_port'] = 2222
+    ports:
+      - "8929:80"
+      - "2222:22"
+    volumes:
+      - gitlab-data:/var/opt/gitlab
+    shm_size: "256m"
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+
+volumes:
+  gitlab-data:

tests/fixtures/docs/homelab/container_gitlab/gitlab.md

@@ -0,0 +1,27 @@
+# Gitlab
+
+Gitlab CE runs as a single Docker container on the `gitlab` host
+(`10.0.1.14`), managed by Ansible (`deployments/gitlab/`).
+
+## Install
+
+1. Install Docker and the compose plugin on the host.
+2. Create the `gitlab-data` volume: `docker volume create gitlab-data`.
+3. Run the stack from `gitlab-compose.yaml`:
+   `docker compose -f gitlab-compose.yaml up -d`
+4. Wait ~2 minutes for the initial gitlab migration to finish.
+
+## Access
+
+- Web UI: https://gitlab.reeseapps.com (Traefik routes it to port 8929).
+- Root password: `gitlab-root-password` file in the repo (rotated yearly).
+- Backup: nightly `gitlab-backup create` at 03:30, copy to BorgBase.
+
+## Operations
+
+- Upgrade gitlab: bump the image tag in the compose file,
+  `docker compose up -d gitlab`, watch the logs for the version banner.
+- Logs: `docker logs -f gitlab` or the gitlab admin area → Admin
+  area → Logs.
+- If the container is OOM-killed, raise the memory limit in the compose
+  file (it needs 4GB free).

tests/fixtures/docs/homelab/networking/static-dns.json

@@ -0,0 +1,14 @@
+{
+  "comment": "Static DNS overrides for the homelab Pi-hole (applied by the ddns updater).",
+  "hosts": {
+    "kafkabridge": "10.0.3.7",
+    "k3s-control": "10.0.1.10",
+    "gitea": "10.0.2.21",
+    "ntfy": "10.0.2.30"
+  },
+  "domains": [
+    "reeseapps.com",
+    "homelab.lan"
+  ],
+  "expiry_days": 365
+}

tests/fixtures/docs/homelab/scripts/uptime_probe.py

@@ -0,0 +1,60 @@
+"""Uptime probe — the homelab healthcheck runner.
+
+Polls every service listed in ``CHECKS`` every 5 minutes and posts a
+failure to the ntfy topic ``homelab-alerts``.
+"""
+from __future__ import annotations
+
+import subprocess
+
+#: (name, health URL) for every long-running service.
+CHECKS: list[tuple[str, str]] = [
+    ("k3s", "https://10.0.1.10:6443/healthz"),
+    ("gitea", "https://gitea.reeseapps.com/api/healthz"),
+    ("ntfy", "https://ntfy.reeseapps.com/health"),
+    ("gitlab", "https://gitlab.reeseapps.com/-/health_check"),
+]
+
+
+def probe(name: str, url: str) -> bool:
+    """One HTTP check; returns True when the service answered 200."""
+    result = subprocess.run(
+        ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "--max-time", "10", url],
+        capture_output=True,
+        text=True,
+    )
+    return result.stdout.strip() == "200"
+
+
+def notify_failure(name: str) -> None:
+    """Push an alert to ntfy (best effort — alerting must not crash the probe)."""
+    subprocess.run(
+        [
+            "curl",
+            "-s",
+            "-X",
+            "POST",
+            "https://ntfy.reeseapps.com/homelab-alerts",
+            "-H",
+            "Title: homelab check failed",
+            "-d",
+            f"{name} is down",
+        ],
+        capture_output=True,
+    )
+
+
+def run_round() -> int:
+    """Probe everything once; returns the number of failing services."""
+    failed = 0
+    for name, url in CHECKS:
+        if not probe(name, url):
+            failed += 1
+            notify_failure(name)
+    return failed
+
+
+if __name__ == "__main__":
+    import sys
+
+    sys.exit(run_round())

tests/fixtures/docs/homelab/ssh/ssh_aliases.txt

@@ -0,0 +1,14 @@
+SSH notes for the homelab jump host.
+
+All admin hosts are reachable through the jump box at 10.0.1.2
+(`ssh reese@jump`). The `~/.ssh/config` aliases:
+
+k3s — the kubernetes control plane node (10.0.1.10, user talos)
+gitlab — the gitlab container host (10.0.1.14)
+nuc — the low-power media box (10.0.1.20)
+
+Keys: ed25519 per host, no passwords. The old RSA key was retired in
+2025 and its line removed from authorized_keys on every host.
+
+Forwarding X11 stays off everywhere; use `ssh -L` port forwards for the
+occasional GUI tool instead.