# Generated by oikos build-hosts from inventory.yaml.
# Do NOT edit by hand.

age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
host: hubris
kind: lxc
lan_ip: 192.168.8.205
mcp_endpoint: https://mcp.hubris.network/mcp
mesh:
  tailscale:
    fqdn: apps
    ip: 100.121.171.122
mesh_globals:
  accepted:
    - netbird
    - tailscale
  primary: netbird
mounts:
  - /mnt/library
name: apps
os: linux
pve_id: 105
role: docker-apps
runs:
  - artifacto
  - plantuml
  - homelab-mcp
  - secrets-issuance
  - artifacto
  - homelab_mcp
  - secrets_issuance
secrets_issuance_endpoint: https://secrets.hubris.network/issue
services_hosted:
  - backend: apps
    config_repo: dtoro/Artifacto
    doc_page: knowledge/wiki/containers/105-apps.md
    name: artifacto
    url: https://artifacto.hubris.network
  - backend: apps
    config_repo: dtoro/Homelab-Docs
    doc_page: knowledge/wiki/infrastructure/homelab-context.md
    endpoint: https://mcp.hubris.network/mcp
    name: homelab_mcp
    note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through hubris).
    port: 9810
    public_host: mcp.hubris.network
    risk_notes: agents' primary read surface — outage degrades every agent to grepping the clone
    systemd_unit: homelab-mcp
  - backend: apps
    config_repo: dtoro/Homelab-Docs
    doc_page: .agents/operations/agent-enrollment.md
    endpoint: https://secrets.hubris.network/issue
    name: secrets_issuance
    note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
    port: 9820
    public_host: secrets.hubris.network
    risk_notes: identity issuance — any change is security-sensitive; key operations are destructive-class
    systemd_unit: secrets-issuance
state: active