services/homelab
2
1
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity
450 Commits 1 Branch 0 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ducoterra f9b5d293ba update pi.md with real pi agent config 
Sync the documented models.json example with the actual
~/.pi/agent/models.json (maxTokens 32000 -> 32768) and add the
full ~/.pi/agent/settings.json to the doc.

LLM-Generated: true
 2026-10-21 00:00:07 -04:00
ducoterra 8bcee5c17f document ops-user pi install and sudoers escalation policy 
Adds the sysadmin setup recipe to the pi notes: run pi as a dedicated `ops`
user with a tightly controlled sudoers allowlist instead of root, so an agent
can do host work without unbounded privilege.

Includes the AGENTS.md to drop at /home/ops/AGENTS.md. It records that the
allowlist is discovered with `sudo -l` (hostnamectl, reboot, the dnf and
systemctl subcommands, firewall-cmd, the ansible shim, libvirt/virsh and
composer-cli, getfacl/setfacl, osbuild-auto.sh, btrfs scrub) and sets the hard
rule for agents: when a command is not on that list, stop, do not attempt
escalation workarounds, and ask the human to add the exact full-path sudoers
line for review before proceeding.

LLM-Generated: true
 2026-10-17 12:26:40 -04:00
ducoterra e94d4f718c add README index for the Raspberry Pi systemd runbooks 
Ties the two runbooks together as one host-agnostic directory: which runbook
solves which problem, a file -> target-path map for the units, and the shared
deploy pattern (one tar | ssh pipe into /root, then install with explicit
modes rather than copying a whole tree into /etc).

States the conventions both units follow - configs under /usr/local as the
source of truth with thin systemd wrappers, idempotent installers that re-derive
desired state and never delete what they did not create, and gap-limited
self-healing so a broken dependency cannot make a unit flap.

Also documents the redaction recipe for pasting a WireGuard config: match
`PrivateKey[[:space:]]*=` because wg-quick strip emits spaces around the `=`,
which a `PrivateKey=` regex misses.

LLM-Generated: true
 2026-10-16 09:08:16 -04:00
ducoterra 3cdbb405ab add WireGuard wg0 watchdog units for always-on SSH 
When SSH to a Pi targets a WireGuard tunnel address, reachability depends on
three things that each fail independently: the unit starting at boot, the NAT
mapping staying open, and the peer hostname still resolving. Rebooting onto a
network with no route to the endpoint previously meant no way back in.

- wg-quick@wg0.service.d/10-boot-resilience.conf: retry a failed boot-time up
  forever (Restart=on-failure, RestartSec=15, StartLimitIntervalSec=0) and cap
  endpoint resolution (WG_ENDPOINT_RESOLUTION_RETRIES=60, TimeoutStartSec=120)
  instead of hanging on the stock infinity.
- wg0-watchdog: POSIX sh healer, oldest symptom first - missing interface or
  peer restarts the unit, a missing PersistentKeepalive is set directly, a
  stale handshake re-points the peer at a freshly resolved endpoint, and a
  very stale one restarts. Restarts are gap-limited so a broken network cannot
  make the unit flap, endpoint resolution falls back to the kernel endpoint
  and then to a last-known-good cache (tunnel DNS may only be reachable
  through the tunnel), and nothing it did not create is ever removed.
  Supports --dry-run.
- wg0-watchdog.service/.timer: oneshot on a 60s timer, first check 30s after
  boot, Persistent=true to catch up after downtime, TimeoutStartSec=120 and
  Nice=10 so a restart cannot wedge the watchdog.
- wg0.conf.template: documents /etc/wireguard/wg0.conf with placeholders only.
  Deliberately omits the DNS key so name resolution does not depend on the
  tunnel (Debian wg-quick has no `DNS = none`), and sets PersistentKeepalive
  25 to hold the NAT mapping for inbound SSH.
- wireguard.md: runbook for the placeholder table, failure modes, deploy, and
  verification.

The real wg0.conf and key material never enter the repo.

LLM-Generated: true
 2026-10-16 09:07:56 -04:00
ducoterra bdee581480 add self-healing root SSH key systemd units 
Headless Pis lose /root/.ssh/authorized_keys to imaging, first-boot tooling,
or config management, which locks out the only SSH account that can fix it.

- ensure-root-ssh-key: idempotent POSIX sh installer. Appends managed public
  keys from /usr/local/share/root-ssh-keys/authorized_keys, never removes or
  rewrites foreign keys, skips lines whose first field is not a known key
  algorithm, and enforces 0700 / 0600 root:root on the key dir and file.
- ensure-root-ssh-key.service: oneshot, ordered Before=ssh.service so the key
  lands before the daemon starts; ConditionPathExists skips it when the
  managed keys file is absent.
- ensure-root-ssh-key.path: PathChanged= + PathModified= on authorized_keys so
  deletes, renames, and in-place edits are healed at runtime, not just at boot.
  Writes only when a key is missing, so the unit settles after one no-op run.
- authorized_keys.example: template with commented placeholder keys only; the
  real file stays on the host.
- root-ssh-key.md: runbook with deploy, verification, revocation steps, and
  the gotcha that systemd has no PathMissing= key.

LLM-Generated: true
 2026-10-16 09:05:54 -04:00
ducoterra 3f14b8ce14 add vllm-radiance R9700 deployment and fp8-kv calibration notes 
Documents the single-GPU (TP1) vllm-radiance deployment on
driveripper-ai, measured KV capacity analysis for the 154K config, and
the full FP8-KV calibration workflow (host prep through runtime
verification) including quadlet changes, deployment steps, and the
remaining matched-control quality gate.

LLM-Generated: true
 2026-10-12 10:31:43 -04:00
ducoterra d9925b931d add sudoers allowlist for ops user automation 
Passwordless sudo access scoped to specific commands (dnf, systemctl,
firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and
maintenance automations on the fedora host.

LLM-Generated: true
 2026-10-12 10:31:36 -04:00
ducoterra be7a4cf0ce Add Raspberry Pi headless configuration notes 
Document bootfs headless setup: userconf.txt password hash, and
discovery/login steps via nmap and ssh.

LLM-Generated: true
 2026-10-10 19:37:23 -04:00
ducoterra 54cd5096df add GUI, screen capture, and audio packages to toolbx image 
kitty, scrot, and Xvfb enable headless browser/UI interaction; ffmpeg and portaudio cover screen recording and audio capture.

LLM-Generated: true
 2026-10-10 18:17:25 -04:00
ducoterra 5e8524761b Add thinking level map to pi model definitions 
Documents the thinkingLevelMap for the juggernaut and turbo models in
the ~/.pi/agent/models.json example, and lowers maxTokens from 128000
to 32000 to match the working configuration.

LLM-Generated: true
 2026-10-03 22:03:52 -04:00
ducoterra 1e45cace0b Add Flatpak version installation reference 
Add documentation for installing a specific Flatpak commit version, including listing available commits and downgrading to a previous one.

LLM-Generated: true
 2026-09-21 21:11:09 -04:00
ducoterra dc108a791e Add devops days presentation, software_pi service, and update software_toolbx 
- Add presentations/devops_days_self_hosting_presentation.md
- Add active/software_pi/ service directory
- Update active/software_toolbx/Containerfile
- Update retired/kubernetes_userspace submodule

LLM-Generated: true
 2026-09-19 12:22:09 -04:00
ducoterra fc91437228 various updates 2026-09-07 11:37:56 -04:00
ducoterra 9995fb29ff add framework desktop docs 2026-08-16 11:14:51 -04:00
ducoterra b531e75413 update ai stack with turbo 2026-05-25 21:40:56 -04:00
ducoterra a56402c2cc update litellm docs
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m8s
Details
2026-05-11 18:22:14 -04:00
ducoterra f2015e2c71 checkpoint commit
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m3s
Details
2026-05-05 06:26:40 -04:00
ducoterra e43c534ceb update instruct and think containers 2026-04-16 16:05:52 -04:00
ducoterra 66f9304cc6 add longhorn demo
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m28s
Details
2026-04-16 13:11:17 -04:00
ducoterra 65b9c8e70e add kubernetes_traefik 2026-04-16 12:37:35 -04:00
ducoterra 8865a11d67 finalize for kube class
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m14s
Details
2026-04-14 10:16:03 -04:00
ducoterra 8b256bda98 add escaping stuck ssh terminals 2026-04-06 11:48:23 -04:00
ducoterra 8136740105 add presentations 2026-04-06 11:48:12 -04:00
ducoterra 171cfed7e3 add scratch dir to gitignore 2026-04-06 11:47:20 -04:00
ducoterra 56257e85d6 add kube hosts to ansible inventory 2026-04-06 11:47:05 -04:00
ducoterra f359a64218 init agentic server monitor scripts
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m4s
Details
2026-04-06 11:46:51 -04:00
ducoterra 3bc92c5889 last updates to wyoming before deprecation 2026-04-06 11:46:21 -04:00
ducoterra 430be75fab updates to fedora 43 image builder 2026-04-06 11:45:59 -04:00
ducoterra 25e812ab55 clean up k3s for new deployment 2026-04-06 11:45:24 -04:00
ducoterra 67b644005a add firewalld log following 2026-04-06 11:45:06 -04:00
ducoterra 9eb79d34f1 add vllm notes 2026-04-06 11:44:53 -04:00
ducoterra 9776f8ed9f update metallb to work for kube 1.35+ 2026-04-06 11:44:45 -04:00
ducoterra 57ec92fc5d add kubectl config set context namespace note 2026-04-06 11:44:28 -04:00
ducoterra 10786dead3 add roku list tv apps 2026-04-06 11:43:52 -04:00
ducoterra a2be3dc1ea add launch.json 2026-04-06 11:43:40 -04:00
ducoterra b78c205c9a update driveripper vm docs to fedora 43 2026-04-06 11:43:29 -04:00
ducoterra 32e78e9bcf fix kubernetes paths
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m9s
Details
2026-03-30 19:22:47 -04:00
ducoterra 47c476a98f working langchain agent_update_check
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m3s
Details
2026-03-25 16:25:24 -04:00
ducoterra 2ac5f980ac driveripper disk monitor agent deployed
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m16s
Details
2026-03-23 23:43:28 -04:00
ducoterra b0fb09d706 initial working system report 2026-03-23 21:08:21 -04:00
ducoterra acf6421b53 add esphome tab5
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m24s
Details
2026-03-16 09:55:31 -04:00
ducoterra 875795a409 add pillow as a dep 2026-03-16 09:55:03 -04:00
ducoterra b9d1c2a9a3 fix minor bug in podman template 2026-03-16 09:54:40 -04:00
ducoterra 6f8b7ffca6 add ai hosts to inventory 2026-03-16 09:54:22 -04:00
ducoterra cc75227a77 reconfigure software ai stack 2026-03-16 09:54:13 -04:00
ducoterra 9ae82fc3de add keychron notes 2026-03-16 09:53:54 -04:00
ducoterra 92edf49948 add quickstart vm notes to driveripper 2026-03-16 09:53:40 -04:00
ducoterra 25d3a7805c add litellm 2026-03-16 09:53:27 -04:00
ducoterra eb67191706 add toybox caddy 2026-03-16 09:53:13 -04:00
ducoterra d51560f979 add bifrost docs 2026-03-16 09:52:57 -04:00
ducoterra 88ecb458e1 tab5 voice assist v0.1
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m10s
Details
2026-03-15 18:21:56 -04:00
ducoterra 31739320aa add apple m4 max benchmark
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m4s
Details
2026-02-25 16:01:08 -05:00
ducoterra f70028cf63 init uv project for homelab
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m26s
Details
2026-02-25 12:23:17 -05:00
ducoterra ecf4ae1058 update templates with new names 2026-02-25 12:22:29 -05:00
ducoterra eff2aa4066 add keys 2026-02-25 12:21:51 -05:00
ducoterra a53e67653d fix restorecon command 2026-02-25 12:21:31 -05:00
ducoterra d48b9a66cb add machinectl to fedora43 base osbuild 2026-02-25 12:21:17 -05:00
ducoterra 2c5af8507c add fedora kernel notes 2026-02-25 12:21:01 -05:00
ducoterra ba66c47719 move ai notes from framework_desktop to software_ai_stack 2026-02-25 12:20:17 -05:00
ducoterra da0b06768e add gpu passthrough notes to driveripper 2026-02-25 12:19:46 -05:00
ducoterra 1c6e1b7032 add container_rabbitmq 2026-02-25 12:19:06 -05:00
ducoterra 087d8888cf remove private nginx.conf 2026-02-25 12:18:44 -05:00
ducoterra cb486ae289 move gitea port to 22 2026-02-25 12:17:39 -05:00
ducoterra cd56318ab0 add container_elk notes 2026-02-25 12:16:30 -05:00
ducoterra 416321206d add caddy waf docs 2026-02-25 12:15:49 -05:00
ducoterra f3c313e610 update bricktracker to 1.3.1
Podman DDNS Image / build-and-push-ddns (push) Successful in 1m8s
Details
2026-02-16 11:16:09 -05:00
ducoterra 52c6dac263 transition to container_ over podman_ 2026-02-16 10:44:38 -05:00
ducoterra d4fbbb185f rename podman_ projects to container_ 2026-02-11 11:34:02 -05:00
ducoterra 7d2e8b6b7b add stories
Podman DDNS Image / build-and-push-ddns (push) Successful in 58s
Details
2026-02-06 20:28:43 -05:00
ducoterra 3bfa67e605 update ansible inventory 2026-02-06 20:28:21 -05:00
ducoterra d929ac8888 wyoming debug probability 2026-02-06 20:27:59 -05:00
ducoterra 837ea91a52 add disk tests for virsh 2026-02-06 20:27:45 -05:00
ducoterra 71a27b1b91 add uv notes 2026-02-06 20:27:27 -05:00
ducoterra 8d250318b1 add systemd examples 2026-02-06 20:27:19 -05:00
ducoterra 041fbd0f5f add snapper notes 2026-02-06 20:24:24 -05:00
ducoterra 498e52c134 add samba user creation notes 2026-02-06 20:24:18 -05:00
ducoterra dd11ef60cb add notes for resizing a qemu images 2026-02-06 20:23:24 -05:00
ducoterra 65208987ea update osbuild with more default packages 2026-02-06 20:23:12 -05:00
ducoterra f530181e73 add openstack notes 2026-02-06 20:22:58 -05:00
ducoterra bcd087dc94 never ever ever ever allow force overwrite luks driver 2026-02-06 20:22:47 -05:00
ducoterra 59bdafed6a freeipa install updates 2026-02-06 20:21:55 -05:00
ducoterra 2a7a177cec firewalld notes 2026-02-06 20:21:46 -05:00
ducoterra fdc0f0f2c5 add podman etc notes 2026-02-06 20:21:33 -05:00
ducoterra 27180d92b1 add more btrfs admin notes 2026-02-06 20:21:11 -05:00
ducoterra 2b62ad0956 clean up borg backup notes 2026-02-06 20:20:56 -05:00
ducoterra fb19c81d47 add podman speedtest 2026-02-06 20:20:37 -05:00
ducoterra 1d39fb4dc6 add podman ollama notes 2026-02-06 20:20:11 -05:00
ducoterra 03c8e95275 nginx updates 2026-02-06 20:19:52 -05:00
ducoterra 90105f8997 add nextcloud aio docker notes 2026-02-06 20:19:36 -05:00
ducoterra c1e083ec04 rename minecraft compose 2026-02-06 20:19:24 -05:00
ducoterra 5b79da95fd add local ai podman docs 2026-02-06 20:19:10 -05:00
ducoterra 1737c7a79a start keycloak docs 2026-02-06 20:18:55 -05:00
ducoterra 8ea3fe5fc4 add docker jellyfin 2026-02-06 20:18:31 -05:00
ducoterra 73d78db715 add docker immich docs 2026-02-06 20:18:19 -05:00
ducoterra e7835970a2 add gitea docker install 2026-02-06 20:18:00 -05:00
ducoterra f242895b51 update podman ddns to be more efficient 2026-02-06 20:17:46 -05:00
ducoterra 70718f209b add certbot 2026-02-06 20:17:16 -05:00
ducoterra d089c981c8 add deskwork caddy 2026-02-06 20:16:51 -05:00
ducoterra 495cacfb96 rename connorbricktracker compose 2026-02-06 20:16:31 -05:00
ducoterra 90ba436a47 add ubuntu 25.10 2026-02-06 20:13:55 -05:00