Sync the documented models.json example with the actual
~/.pi/agent/models.json (maxTokens 32000 -> 32768) and add the
full ~/.pi/agent/settings.json to the doc.
LLM-Generated: true
Adds the sysadmin setup recipe to the pi notes: run pi as a dedicated `ops`
user with a tightly controlled sudoers allowlist instead of root, so an agent
can do host work without unbounded privilege.
Includes the AGENTS.md to drop at /home/ops/AGENTS.md. It records that the
allowlist is discovered with `sudo -l` (hostnamectl, reboot, the dnf and
systemctl subcommands, firewall-cmd, the ansible shim, libvirt/virsh and
composer-cli, getfacl/setfacl, osbuild-auto.sh, btrfs scrub) and sets the hard
rule for agents: when a command is not on that list, stop, do not attempt
escalation workarounds, and ask the human to add the exact full-path sudoers
line for review before proceeding.
LLM-Generated: true
Ties the two runbooks together as one host-agnostic directory: which runbook
solves which problem, a file -> target-path map for the units, and the shared
deploy pattern (one tar | ssh pipe into /root, then install with explicit
modes rather than copying a whole tree into /etc).
States the conventions both units follow - configs under /usr/local as the
source of truth with thin systemd wrappers, idempotent installers that re-derive
desired state and never delete what they did not create, and gap-limited
self-healing so a broken dependency cannot make a unit flap.
Also documents the redaction recipe for pasting a WireGuard config: match
`PrivateKey[[:space:]]*=` because wg-quick strip emits spaces around the `=`,
which a `PrivateKey=` regex misses.
LLM-Generated: true
When SSH to a Pi targets a WireGuard tunnel address, reachability depends on
three things that each fail independently: the unit starting at boot, the NAT
mapping staying open, and the peer hostname still resolving. Rebooting onto a
network with no route to the endpoint previously meant no way back in.
- wg-quick@wg0.service.d/10-boot-resilience.conf: retry a failed boot-time up
forever (Restart=on-failure, RestartSec=15, StartLimitIntervalSec=0) and cap
endpoint resolution (WG_ENDPOINT_RESOLUTION_RETRIES=60, TimeoutStartSec=120)
instead of hanging on the stock infinity.
- wg0-watchdog: POSIX sh healer, oldest symptom first - missing interface or
peer restarts the unit, a missing PersistentKeepalive is set directly, a
stale handshake re-points the peer at a freshly resolved endpoint, and a
very stale one restarts. Restarts are gap-limited so a broken network cannot
make the unit flap, endpoint resolution falls back to the kernel endpoint
and then to a last-known-good cache (tunnel DNS may only be reachable
through the tunnel), and nothing it did not create is ever removed.
Supports --dry-run.
- wg0-watchdog.service/.timer: oneshot on a 60s timer, first check 30s after
boot, Persistent=true to catch up after downtime, TimeoutStartSec=120 and
Nice=10 so a restart cannot wedge the watchdog.
- wg0.conf.template: documents /etc/wireguard/wg0.conf with placeholders only.
Deliberately omits the DNS key so name resolution does not depend on the
tunnel (Debian wg-quick has no `DNS = none`), and sets PersistentKeepalive
25 to hold the NAT mapping for inbound SSH.
- wireguard.md: runbook for the placeholder table, failure modes, deploy, and
verification.
The real wg0.conf and key material never enter the repo.
LLM-Generated: true
Headless Pis lose /root/.ssh/authorized_keys to imaging, first-boot tooling,
or config management, which locks out the only SSH account that can fix it.
- ensure-root-ssh-key: idempotent POSIX sh installer. Appends managed public
keys from /usr/local/share/root-ssh-keys/authorized_keys, never removes or
rewrites foreign keys, skips lines whose first field is not a known key
algorithm, and enforces 0700 / 0600 root:root on the key dir and file.
- ensure-root-ssh-key.service: oneshot, ordered Before=ssh.service so the key
lands before the daemon starts; ConditionPathExists skips it when the
managed keys file is absent.
- ensure-root-ssh-key.path: PathChanged= + PathModified= on authorized_keys so
deletes, renames, and in-place edits are healed at runtime, not just at boot.
Writes only when a key is missing, so the unit settles after one no-op run.
- authorized_keys.example: template with commented placeholder keys only; the
real file stays on the host.
- root-ssh-key.md: runbook with deploy, verification, revocation steps, and
the gotcha that systemd has no PathMissing= key.
LLM-Generated: true
Documents the single-GPU (TP1) vllm-radiance deployment on
driveripper-ai, measured KV capacity analysis for the 154K config, and
the full FP8-KV calibration workflow (host prep through runtime
verification) including quadlet changes, deployment steps, and the
remaining matched-control quality gate.
LLM-Generated: true
Passwordless sudo access scoped to specific commands (dnf, systemctl,
firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and
maintenance automations on the fedora host.
LLM-Generated: true
Documents the thinkingLevelMap for the juggernaut and turbo models in
the ~/.pi/agent/models.json example, and lowers maxTokens from 128000
to 32000 to match the working configuration.
LLM-Generated: true
Add documentation for installing a specific Flatpak commit version, including listing available commits and downgrading to a previous one.
LLM-Generated: true
ducoterra