dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Oikos Week 1: kernel policy, ontology, service contract, topology gen

Browse Source 
Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes +
approval rules for every homelab/MCP command), oikos/ontology.yaml
(8-domain systems model, typed relationships, node lifecycle), and
OIKOS.md (OODA loop operating brief, linked from AGENTS.md).

Extends inventory.yaml with a stable service contract (doc_page,
config_repo, risk_notes) on all 17 services, and a structured
archaeology: section for the 13 destroyed LXCs (was scattered
comments + a narrative table). Fixes stale drift found in the
process: authentik's backend pointed at a retired LXC (124); core
has run on the VPS since 2026-05-31.

Adds oikos/gen-topology.py, generating infrastructure/topology.md
(Mermaid compute/ingress + storage views) from inventory.yaml.
build_host_files.py now carries state/storage/depends_on into
generated hosts/*.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-05 22:50:34 +02:00
parent 7e8860ab47
commit b230ab5937
34 changed files with 832 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

123
inventory.yaml
View File

@@ -35,72 +35,118 @@ mesh:
- tailscale
netbird_subnet: 100.122.0.0/16
netbird_domain: netbird.selfhosted
# Service contract (Oikos, 2026-07-05): each service should carry
# backend host/container that runs it (required)
# url public URL if ingress-exposed
# doc_page owning wiki page
# config_repo tracked config repo, if any (mutations go commit+push)
# health health-check URL if it differs from `url`
# risk_notes what an agent must know before touching it
# See oikos/ontology.yaml + oikos/policy.yaml.
services:
proxmox_ui:
url: https://proxmox.hubris.network
backend: hubris
port: 8006
doc_page: hosts/hubris.md
risk_notes: hypervisor UI — changes here affect every guest on the node
gitea:
url: https://git.hubris.network
backend: gitea
backend_url: http://192.168.8.121:3000
doc_page: containers/104-gitea.md
config_repo: dtoro/gitea-customizations
risk_notes: hosts all config repos + deploy webhooks; outage blocks auto-deploy and sync
caddy:
backend: caddy
role: reverse-proxy
note: terminates all *.hubris.network
doc_page: containers/121-caddy.md
config_repo: dtoro/caddy-conf
risk_notes: wide blast radius — every *.hubris.network route rides on it (see oikos/policy.yaml service_overrides)
authentik:
url: https://auth.hubris.network
backend: authentik
dns:
backend: netbird-vps
doc_page: containers/106-auth-outpost.md
note: >-
core runs on the VPS since 2026-05-31; LAN forward-auth outpost is
auth-outpost (LXC 106) at 192.168.8.6:9000. Previous backend value
"authentik" referenced the retired embedded-outpost host (LXC 124).
risk_notes: SSO provider — outage locks login to OIDC/forward-auth services
dns:
backend: dns
note: Technitium DNS, split-horizon zone
doc_page: containers/107-dns.md
risk_notes: LAN-wide resolver — misconfig breaks name resolution for every client
jellyfin:
url: https://media.hubris.network
backend: jellyfin
doc_page: containers/101-jellyfin.md
risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends on GPU passthrough on strong
nextcloud:
url: https://cloud.hubris.network
backend: nextcloud
doc_page: containers/114-nextcloud.md
paperless:
url: https://paperless.hubris.network
backend: paperless
doc_page: containers/103-paperless.md
risk_notes: document archive — treat data as irreplaceable; DB operations are destructive-class
matrix:
url: https://matrix.hubris.network
backend: elementsynapse
doc_page: containers/118-elementsynapse.md
risk_notes: alert/approval channel for Oikos — outage silences agent escalation
photos:
url: https://photos.hubris.network
backend: mule-images
doc_page: containers/120-mule-images.md
config_repo: dtoro/mule-image
arr_stack:
backend: arriman
note: jellyseerr / qbit / sab on docker compose
doc_page: containers/122-arriman.md
artifacto:
backend: apps
url: https://artifacto.hubris.network
doc_page: containers/105-apps.md
config_repo: dtoro/Artifacto
trmnl:
backend: trmnl
url: https://trmnl.hubris.network
note: self-hosted middleware for TRMNL e-ink plugins (polled by TRMNL cloud)
doc_page: containers/128-trmnl.md
config_repo: dtoro/terminalito
zimaos:
url: https://zimaos.hubris.network
backend: zimaos
doc_page: vms/100-zimaos.md
haos:
backend: haos
doc_page: vms/108-haos.md
homelab_mcp:
backend: apps
port: 9810
systemd_unit: homelab-mcp
public_host: mcp.hubris.network
endpoint: https://mcp.hubris.network/mcp
doc_page: infrastructure/homelab-context.md
config_repo: dtoro/Homelab-Docs
note: MCP server. Read-only context + management. Reachable on the LAN via Caddy
and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through
hubris).
risk_notes: agents' primary read surface — outage degrades every agent to grepping the clone
secrets_issuance:
backend: apps
port: 9820
systemd_unit: secrets-issuance
public_host: secrets.hubris.network
endpoint: https://secrets.hubris.network/issue
doc_page: operations/agent-enrollment.md
config_repo: dtoro/Homelab-Docs
note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN
subnets in MESH_SUBNETS).
risk_notes: identity issuance — any change is security-sensitive; key operations are destructive-class
hosts:
hubris:
kind: proxmox-host
@@ -374,8 +420,6 @@ hosts:
- MariaDB sidecar at /opt/romm/docker-compose.yml.
- ROMs on ludo-lvm media volume at /mnt/media_local/roms.
- 1 core / 2 GiB RAM / 16 GiB rootfs (ludo-lvm).
# 123 (claudio-bot) — destroyed 2026-06-04, replaced by Hermes Agent
# 126 (plato) — destroyed 2026-06-28, notes workspace decommissioned
zimaos:
kind: vm
pve_id: 100
@@ -470,3 +514,74 @@ hosts:
netbird:
fqdn: rclone.netbird.selfhosted
age_pubkey: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
# Destroyed nodes (lifecycle state: destroyed — see oikos/ontology.yaml).
# Kept so agents can answer "what happened to X?" from structured data and
# so drift detectors can flag anything still referencing them.
# Full narrative table: containers/index.md "Recently destroyed".
archaeology:
claudio-bot:
kind: lxc
pve_id: 123
destroyed: 2026-06-04
reason: replaced by Hermes Agent on mac-mini; monitoring moved to homelab-health-watchdog cron
plato:
kind: lxc
pve_id: 126
destroyed: 2026-06-28
reason: notes workspace decommissioned; data retained at /mnt/library/documents/plato
mule-photos-new:
kind: lxc
pve_id: 127
destroyed: 2026-05-22
reason: PhotoPrism test stack promoted to LXC 120 (Mulimage 2.0 merge)
heaper:
kind: lxc
pve_id: 116
destroyed: 2026-05-14
reason: decommissioned; data retained at /mnt/library/heaper
syncthing:
kind: lxc
pve_id: 109
destroyed: 2026-05-14
reason: decommissioned; library subtree was empty
seafile:
kind: lxc
pve_id: 125
destroyed: 2026-05-13
reason: Seafile Pro evaluation rejected; files.hubris.network removed from caddy + dns
arr-yunohost:
kind: lxc
pve_id: 100
destroyed: 2026-04-28
reason: migrated to docker stack on arriman (LXC 122)
flaresolverr:
kind: lxc
pve_id: 106
destroyed: 2026-04-28
reason: folded into the arriman docker compose
marimo:
kind: lxc
pve_id: 107
destroyed: 2026-04-28
reason: decommissioned
photoprism:
kind: lxc
pve_id: 110
destroyed: 2026-04-28
reason: replaced by mule-images (LXC 120)
karakeep:
kind: lxc
pve_id: 111
destroyed: 2026-04-28
reason: decommissioned
immich:
kind: lxc
pve_id: 112
destroyed: 2026-04-28
reason: replaced by mule-images (LXC 120)
reticulum:
kind: lxc
pve_id: 115
destroyed: 2026-04-28
reason: decommissioned