dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

client-add: claudio-bot (finalize age_pubkey + grant shared secrets)

Browse Source
This commit is contained in:
root
2026-05-20 18:39:27 +02:00
parent af8961d194
commit 047138a81d
2 changed files with 129 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/claudio-bot.yaml
View File

@@ -18,6 +18,7 @@ mesh_globals:
- tailscale - tailscale
notes: notes:
- Reads /opt/homelab-context/ on startup - Reads /opt/homelab-context/ on startup
age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
see_also: see_also:
- containers/123-claudio-bot.md - containers/123-claudio-bot.md
mcp_endpoint: https://mcp.hubris.network/sse mcp_endpoint: https://mcp.hubris.network/sse

272
inventory.yaml
View File

@@ -1,125 +1,77 @@
# Homelab inventory — canonical structured topology
#
# This file is the single source of truth for hosts, services, and mesh
# addresses. Everything in hosts/*.yaml is generated from this file by
# mcp/build_host_files.py — do not edit hosts/*.yaml by hand.
#
# Conventions:
# - hostname keys here MUST match the actual `hostname` of the machine
# (or, on macOS, `scutil --get LocalHostName` if set).
# - `os:` one of: linux, macos
# - `kind:` one of: proxmox-host, lxc, vm, workstation
# - `mesh:` lists addresses the host is reachable at. Both `netbird` and
# `tailscale` are accepted during the in-flight migration
# (see infrastructure/mesh.md). Prefer netbird FQDNs over raw IPs.
# - `age_pubkey:` is provisioned by the secrets-issuance service on first
# bootstrap and committed back here. New entries leave it empty.
# - When a service moves hosts, update only the `services:` section here;
# never duplicate the address elsewhere.
# ---------------------------------------------------------------------------
# Static config (mesh + service endpoints)
# ---------------------------------------------------------------------------
mesh: mesh:
primary: netbird # preferred for new clients primary: netbird
accepted: [netbird, tailscale] accepted:
- netbird
- tailscale
netbird_subnet: 100.122.0.0/16 netbird_subnet: 100.122.0.0/16
netbird_domain: netbird.selfhosted netbird_domain: netbird.selfhosted
# Top-level service registry. Each entry resolves to a host above plus a URL.
services: services:
proxmox_ui: proxmox_ui:
url: https://proxmox.hubris.network url: https://proxmox.hubris.network
backend: hubris backend: hubris
port: 8006 port: 8006
gitea: gitea:
url: https://git.hubris.network url: https://git.hubris.network
backend: gitea backend: gitea
backend_url: http://192.168.8.121:3000 backend_url: http://192.168.8.121:3000
caddy: caddy:
backend: caddy backend: caddy
role: reverse-proxy role: reverse-proxy
note: terminates all *.hubris.network note: terminates all *.hubris.network
authentik: authentik:
url: https://auth.hubris.network url: https://auth.hubris.network
backend: authentik backend: authentik
dnsmasq: dnsmasq:
backend: authentik backend: authentik
note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf
jellyfin: jellyfin:
url: https://media.hubris.network url: https://media.hubris.network
backend: jellyfin backend: jellyfin
nextcloud: nextcloud:
url: https://cloud.hubris.network url: https://cloud.hubris.network
backend: nextcloud backend: nextcloud
paperless: paperless:
url: https://paperless.hubris.network url: https://paperless.hubris.network
backend: paperless backend: paperless
matrix: matrix:
url: https://matrix.hubris.network url: https://matrix.hubris.network
backend: elementsynapse backend: elementsynapse
photos: photos:
url: https://photos.hubris.network url: https://photos.hubris.network
backend: mule-images backend: mule-images
photos_new: photos_new:
url: https://photos-new.hubris.network url: https://photos-new.hubris.network
backend: mule-photos-new backend: mule-photos-new
plato: plato:
url: https://plato.hubris.network url: https://plato.hubris.network
backend: plato backend: plato
arr_stack: arr_stack:
backend: arriman backend: arriman
note: jellyseerr / qbit / sab on docker compose note: jellyseerr / qbit / sab on docker compose
artifacto: artifacto:
backend: apps backend: apps
url: https://artifacto.hubris.network url: https://artifacto.hubris.network
zimaos: zimaos:
url: https://zimaos.hubris.network url: https://zimaos.hubris.network
backend: zimaos backend: zimaos
haos: haos:
backend: haos backend: haos
# New services introduced by this plan.
homelab_mcp: homelab_mcp:
backend: apps backend: apps
port: 9810 port: 9810
public_host: mcp.hubris.network public_host: mcp.hubris.network
endpoint: https://mcp.hubris.network/sse endpoint: https://mcp.hubris.network/sse
note: MCP server. Read-only context + management. Reachable on the LAN note: MCP server. Read-only context + management. Reachable on the LAN via Caddy
via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through
resource routed through hubris). hubris).
secrets_issuance: secrets_issuance:
backend: apps backend: apps
port: 9820 port: 9820
public_host: secrets.hubris.network public_host: secrets.hubris.network
endpoint: https://secrets.hubris.network/issue endpoint: https://secrets.hubris.network/issue
note: Issues per-client age private keys. Gated at source-IP layer note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN
(mesh + LAN subnets in MESH_SUBNETS). subnets in MESH_SUBNETS).
# ---------------------------------------------------------------------------
# Hosts (Proxmox host + LXCs + VMs + workstations)
# ---------------------------------------------------------------------------
hosts: hosts:
# ----- The hypervisor -----
hubris: hubris:
kind: proxmox-host kind: proxmox-host
os: linux os: linux
@@ -130,13 +82,11 @@ hosts:
ip: 100.122.38.109 ip: 100.122.38.109
fqdn: proxmox-server.netbird.selfhosted fqdn: proxmox-server.netbird.selfhosted
ssh: ssh:
port: 22 # OpenSSH port: 22
netbird_port: 22022 # see infrastructure/ssh-access.md netbird_port: 22022
mounts: mounts:
- /mnt/library # shared lvmthin - /mnt/library
age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
# ----- LXC containers (all on hubris) -----
jellyfin: jellyfin:
kind: lxc kind: lxc
pve_id: 101 pve_id: 101
@@ -145,10 +95,12 @@ hosts:
role: media-server role: media-server
lan_ip: 192.168.8.206 lan_ip: 192.168.8.206
public_host: media.hubris.network public_host: media.hubris.network
mesh: {netbird: {fqdn: jellyfin.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
age_pubkey: "" fqdn: jellyfin.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
nfs-export: nfs-export:
kind: lxc kind: lxc
pve_id: 102 pve_id: 102
@@ -156,9 +108,10 @@ hosts:
os: linux os: linux
role: storage-export role: storage-export
lan_ip: 192.168.8.200 lan_ip: 192.168.8.200
mesh: {netbird: {fqdn: nfs-export.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: nfs-export.netbird.selfhosted
age_pubkey: ''
paperless: paperless:
kind: lxc kind: lxc
pve_id: 103 pve_id: 103
@@ -167,10 +120,12 @@ hosts:
role: document-archive role: document-archive
lan_ip: 192.168.8.130 lan_ip: 192.168.8.130
public_host: paperless.hubris.network public_host: paperless.hubris.network
mesh: {netbird: {fqdn: paperless.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
age_pubkey: "" fqdn: paperless.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
gitea: gitea:
kind: lxc kind: lxc
pve_id: 104 pve_id: 104
@@ -180,12 +135,14 @@ hosts:
lan_ip: 192.168.8.121 lan_ip: 192.168.8.121
public_host: git.hubris.network public_host: git.hubris.network
backend_port: 3000 backend_port: 3000
mesh: {netbird: {fqdn: gitea.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
fqdn: gitea.netbird.selfhosted
mounts:
- /mnt/library
notes: notes:
- "Bare repos live at /mnt/library/repos/dtoro/*.git" - Bare repos live at /mnt/library/repos/dtoro/*.git
age_pubkey: "" age_pubkey: ''
apps: apps:
kind: lxc kind: lxc
pve_id: 105 pve_id: 105
@@ -193,18 +150,21 @@ hosts:
os: linux os: linux
role: docker-apps role: docker-apps
lan_ip: 192.168.8.205 lan_ip: 192.168.8.205
public_hosts: [artifacto.hubris.network] public_hosts:
- artifacto.hubris.network
mesh: mesh:
netbird: {fqdn: apps.netbird.selfhosted} netbird:
tailscale: {ip: 100.121.171.122} fqdn: apps.netbird.selfhosted
mounts: [/mnt/library] tailscale:
ip: 100.121.171.122
mounts:
- /mnt/library
runs: runs:
- artifacto - artifacto
- plantuml - plantuml
- homelab-mcp # introduced by this plan - homelab-mcp
- secrets-issuance # introduced by this plan - secrets-issuance
age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
nextcloud: nextcloud:
kind: lxc kind: lxc
pve_id: 114 pve_id: 114
@@ -213,10 +173,12 @@ hosts:
role: file-sync role: file-sync
lan_ip: 192.168.8.224 lan_ip: 192.168.8.224
public_host: cloud.hubris.network public_host: cloud.hubris.network
mesh: {netbird: {fqdn: nextcloud.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
age_pubkey: "" fqdn: nextcloud.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
elementsynapse: elementsynapse:
kind: lxc kind: lxc
pve_id: 118 pve_id: 118
@@ -225,9 +187,10 @@ hosts:
role: matrix-server role: matrix-server
lan_ip: 192.168.8.239 lan_ip: 192.168.8.239
public_host: matrix.hubris.network public_host: matrix.hubris.network
mesh: {netbird: {fqdn: elementsynapse.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: elementsynapse.netbird.selfhosted
age_pubkey: ''
sophia: sophia:
kind: lxc kind: lxc
pve_id: 119 pve_id: 119
@@ -235,10 +198,12 @@ hosts:
os: linux os: linux
role: workshop role: workshop
lan_ip: 192.168.8.157 lan_ip: 192.168.8.157
mesh: {netbird: {fqdn: sophia.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
age_pubkey: "" fqdn: sophia.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
mule-images: mule-images:
kind: lxc kind: lxc
pve_id: 120 pve_id: 120
@@ -247,10 +212,12 @@ hosts:
role: photo-management role: photo-management
lan_ip: 192.168.8.136 lan_ip: 192.168.8.136
public_host: photos.hubris.network public_host: photos.hubris.network
mesh: {netbird: {fqdn: mule-images.netbird.selfhosted}} mesh:
mounts: [/mnt/library] netbird:
age_pubkey: "" fqdn: mule-images.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
caddy: caddy:
kind: lxc kind: lxc
pve_id: 121 pve_id: 121
@@ -259,12 +226,15 @@ hosts:
role: reverse-proxy role: reverse-proxy
lan_ip: 192.168.8.175 lan_ip: 192.168.8.175
notes: notes:
- "Terminates all *.hubris.network" - Terminates all *.hubris.network
- "/etc/caddy is a git checkout of dtoro/caddy-conf" - /etc/caddy is a git checkout of dtoro/caddy-conf
peers: [authentik, gitea] peers:
mesh: {netbird: {fqdn: caddy.netbird.selfhosted}} - authentik
age_pubkey: "" - gitea
mesh:
netbird:
fqdn: caddy.netbird.selfhosted
age_pubkey: ''
arriman: arriman:
kind: lxc kind: lxc
pve_id: 122 pve_id: 122
@@ -272,11 +242,16 @@ hosts:
os: linux os: linux
role: arr-stack role: arr-stack
lan_ip: 192.168.8.132 lan_ip: 192.168.8.132
public_hosts: [jellyseerr.hubris.network, qbit.hubris.network, sab.hubris.network] public_hosts:
mesh: {netbird: {fqdn: arriman.netbird.selfhosted}} - jellyseerr.hubris.network
mounts: [/mnt/library] - qbit.hubris.network
age_pubkey: "" - sab.hubris.network
mesh:
netbird:
fqdn: arriman.netbird.selfhosted
mounts:
- /mnt/library
age_pubkey: ''
claudio-bot: claudio-bot:
kind: lxc kind: lxc
pve_id: 123 pve_id: 123
@@ -284,11 +259,12 @@ hosts:
os: linux os: linux
role: matrix-agent role: matrix-agent
lan_ip: 192.168.8.230 lan_ip: 192.168.8.230
mesh: {netbird: {fqdn: claudio-bot.netbird.selfhosted}} mesh:
netbird:
fqdn: claudio-bot.netbird.selfhosted
notes: notes:
- "Reads /opt/homelab-context/ on startup" - Reads /opt/homelab-context/ on startup
age_pubkey: "" age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
authentik: authentik:
kind: lxc kind: lxc
pve_id: 124 pve_id: 124
@@ -298,10 +274,11 @@ hosts:
lan_ip: 192.168.8.180 lan_ip: 192.168.8.180
public_host: auth.hubris.network public_host: auth.hubris.network
notes: notes:
- "Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf" - 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
mesh: {netbird: {fqdn: authentik.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: authentik.netbird.selfhosted
age_pubkey: ''
plato: plato:
kind: lxc kind: lxc
pve_id: 126 pve_id: 126
@@ -310,10 +287,12 @@ hosts:
role: app role: app
lan_ip: 192.168.8.190 lan_ip: 192.168.8.190
public_host: plato.hubris.network public_host: plato.hubris.network
mesh: {netbird: {fqdn: plato.netbird.selfhosted}} mesh:
mounts: [/mnt/library/documents/plato] netbird:
age_pubkey: "" fqdn: plato.netbird.selfhosted
mounts:
- /mnt/library/documents/plato
age_pubkey: ''
mule-photos-new: mule-photos-new:
kind: lxc kind: lxc
pve_id: 127 pve_id: 127
@@ -322,10 +301,10 @@ hosts:
role: photo-management role: photo-management
lan_ip: 192.168.8.181 lan_ip: 192.168.8.181
public_host: photos-new.hubris.network public_host: photos-new.hubris.network
mesh: {netbird: {fqdn: mule-photos-new.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: mule-photos-new.netbird.selfhosted
# ----- VMs (on hubris) ----- age_pubkey: ''
zimaos: zimaos:
kind: vm kind: vm
pve_id: 100 pve_id: 100
@@ -333,38 +312,43 @@ hosts:
os: linux os: linux
role: nas-frontend-eval role: nas-frontend-eval
public_host: zimaos.hubris.network public_host: zimaos.hubris.network
mesh: {netbird: {fqdn: zimaos.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: zimaos.netbird.selfhosted
age_pubkey: ''
haos: haos:
kind: vm kind: vm
pve_id: 108 pve_id: 108
host: hubris host: hubris
os: linux os: linux
role: home-automation role: home-automation
mesh: {netbird: {fqdn: haos.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: haos.netbird.selfhosted
# ----- Workstations (roaming, primary agent clients) ----- age_pubkey: ''
republic-laptop: republic-laptop:
kind: workstation kind: workstation
os: linux os: linux
role: primary-dev role: primary-dev
mesh: {netbird: {fqdn: republic-laptop.netbird.selfhosted}} mesh:
netbird:
fqdn: republic-laptop.netbird.selfhosted
age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
mac-mini: mac-mini:
kind: workstation kind: workstation
os: macos os: macos
role: dev role: dev
mesh: {netbird: {fqdn: mac-mini.netbird.selfhosted}} mesh:
netbird:
fqdn: mac-mini.netbird.selfhosted
notes: notes:
- "Only macOS in the fleet. Bootstrap uses launchd." - Only macOS in the fleet. Bootstrap uses launchd.
age_pubkey: "" age_pubkey: ''
ludo-mini: ludo-mini:
kind: workstation kind: workstation
os: linux os: linux
role: dev role: dev
mesh: {netbird: {fqdn: ludo-mini.netbird.selfhosted}} mesh:
age_pubkey: "" netbird:
fqdn: ludo-mini.netbird.selfhosted
age_pubkey: ''