Use mcp/secrets.hubris.network for the canonical endpoints

Caddy + split-horizon DNS now resolve these to LXC 105 (via 121). Workstations off-LAN reach them via Netbird (192.168.8.0/24 is a network resource routed through hubris). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20 17:17:19 +02:00
parent a7d2a7a08c
commit c5fa756c7d
23 changed files with 61 additions and 57 deletions
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -20,9 +20,9 @@ set -euo pipefail
 # -------- defaults --------
 REPO_HTTPS="${HOMELAB_REPO_URL:-https://git.hubris.network/dtoro/Homelab-Docs.git}"
 CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab-context}"
-ISSUANCE_URL_NETBIRD="${HOMELAB_ISSUANCE_NETBIRD:-http://apps.netbird.selfhosted:9820/issue}"
-ISSUANCE_URL_TAILSCALE="${HOMELAB_ISSUANCE_TAILSCALE:-http://apps.ts:9820/issue}"
-MCP_URL="${HOMELAB_MCP_URL:-http://apps.netbird.selfhosted:9810/sse}"
+ISSUANCE_URL_NETBIRD="${HOMELAB_ISSUANCE_NETBIRD:-https://secrets.hubris.network/issue}"
+ISSUANCE_URL_TAILSCALE="${HOMELAB_ISSUANCE_TAILSCALE:-https://secrets.hubris.network/issue}"
+MCP_URL="${HOMELAB_MCP_URL:-https://mcp.hubris.network/sse}"

 WITH_MCP=0
 DRY_RUN=0
--- a/hosts/apps.yaml
+++ b/hosts/apps.yaml
@@ -37,17 +37,18 @@ services_hosted:
 - name: homelab_mcp
  backend: apps
  port: 9810
-  netbird_host: apps.netbird.selfhosted
-  endpoint: http://apps.netbird.selfhosted:9810/sse
-  note: MCP server. Read-only context + management. Mesh-only.
+  public_host: mcp.hubris.network
+  endpoint: https://mcp.hubris.network/sse
+  note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via
+    Netbird (192.168.8.0/24 is a network resource routed through hubris).
 - name: secrets_issuance
  backend: apps
  port: 9820
-  netbird_host: apps.netbird.selfhosted
-  endpoint: http://apps.netbird.selfhosted:9820/issue
-  note: Issues per-client age private keys. Mesh-only.
+  public_host: secrets.hubris.network
+  endpoint: https://secrets.hubris.network/issue
+  note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
 age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 see_also:
 - containers/105-apps.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/arriman.yaml
+++ b/hosts/arriman.yaml
@@ -30,5 +30,5 @@ services_hosted:
  note: jellyseerr / qbit / sab on docker compose
 see_also:
 - containers/122-arriman.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/authentik.yaml
+++ b/hosts/authentik.yaml
@@ -31,5 +31,5 @@ notes:
 - 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
 see_also:
 - containers/124-authentik.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/caddy.yaml
+++ b/hosts/caddy.yaml
@@ -31,5 +31,5 @@ notes:
 - /etc/caddy is a git checkout of dtoro/caddy-conf
 see_also:
 - containers/121-caddy.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/claudio-bot.yaml
+++ b/hosts/claudio-bot.yaml
@@ -20,5 +20,5 @@ notes:
 - Reads /opt/homelab-context/ on startup
 see_also:
 - containers/123-claudio-bot.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/elementsynapse.yaml
+++ b/hosts/elementsynapse.yaml
@@ -25,5 +25,5 @@ services_hosted:
  backend: elementsynapse
 see_also:
 - containers/118-elementsynapse.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/gitea.yaml
+++ b/hosts/gitea.yaml
@@ -30,5 +30,5 @@ notes:
 - Bare repos live at /mnt/library/repos/dtoro/*.git
 see_also:
 - containers/104-gitea.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/haos.yaml
+++ b/hosts/haos.yaml
@@ -22,5 +22,5 @@ services_hosted:
  backend: haos
 see_also:
 - vms/108-haos.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/hubris.yaml
+++ b/hosts/hubris.yaml
@@ -30,5 +30,5 @@ services_hosted:
 age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 see_also:
 - hosts/hubris.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/jellyfin.yaml
+++ b/hosts/jellyfin.yaml
@@ -27,5 +27,5 @@ services_hosted:
  backend: jellyfin
 see_also:
 - containers/101-jellyfin.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/ludo-mini.yaml
+++ b/hosts/ludo-mini.yaml
@@ -13,5 +13,5 @@ mesh_globals:
  accepted:
  - netbird
  - tailscale
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/mac-mini.yaml
+++ b/hosts/mac-mini.yaml
@@ -15,5 +15,5 @@ mesh_globals:
  - tailscale
 notes:
 - Only macOS in the fleet. Bootstrap uses launchd.
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/mule-images.yaml
+++ b/hosts/mule-images.yaml
@@ -27,5 +27,5 @@ services_hosted:
  backend: mule-images
 see_also:
 - containers/120-mule-images.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/mule-photos-new.yaml
+++ b/hosts/mule-photos-new.yaml
@@ -25,5 +25,5 @@ services_hosted:
  backend: mule-photos-new
 see_also:
 - containers/127-mule-photos-new.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/nextcloud.yaml
+++ b/hosts/nextcloud.yaml
@@ -27,5 +27,5 @@ services_hosted:
  backend: nextcloud
 see_also:
 - containers/114-nextcloud.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/nfs-export.yaml
+++ b/hosts/nfs-export.yaml
@@ -18,5 +18,5 @@ mesh_globals:
  - tailscale
 see_also:
 - containers/102-nfs-export.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/paperless.yaml
+++ b/hosts/paperless.yaml
@@ -27,5 +27,5 @@ services_hosted:
  backend: paperless
 see_also:
 - containers/103-paperless.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/plato.yaml
+++ b/hosts/plato.yaml
@@ -27,5 +27,5 @@ services_hosted:
  backend: plato
 see_also:
 - containers/126-plato.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/republic-laptop.yaml
+++ b/hosts/republic-laptop.yaml
@@ -13,5 +13,5 @@ mesh_globals:
  accepted:
  - netbird
  - tailscale
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/sophia.yaml
+++ b/hosts/sophia.yaml
@@ -20,5 +20,5 @@ mounts:
 - /mnt/library
 see_also:
 - containers/119-sophia.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/zimaos.yaml
+++ b/hosts/zimaos.yaml
@@ -24,5 +24,5 @@ services_hosted:
  backend: zimaos
 see_also:
 - vms/100-zimaos.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -99,16 +99,19 @@ services:
  homelab_mcp:
    backend: apps
    port: 9810
-    netbird_host: apps.netbird.selfhosted
-    endpoint: http://apps.netbird.selfhosted:9810/sse
-    note: MCP server. Read-only context + management. Mesh-only.
+    public_host: mcp.hubris.network
+    endpoint: https://mcp.hubris.network/sse
+    note: MCP server. Read-only context + management. Reachable on the LAN
+      via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network
+      resource routed through hubris).

  secrets_issuance:
    backend: apps
    port: 9820
-    netbird_host: apps.netbird.selfhosted
-    endpoint: http://apps.netbird.selfhosted:9820/issue
-    note: Issues per-client age private keys. Mesh-only.
+    public_host: secrets.hubris.network
+    endpoint: https://secrets.hubris.network/issue
+    note: Issues per-client age private keys. Gated at source-IP layer
+      (mesh + LAN subnets in MESH_SUBNETS).

 # ---------------------------------------------------------------------------
 # Hosts (Proxmox host + LXCs + VMs + workstations)