dtoro
b230ab5937
Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes + approval rules for every homelab/MCP command), oikos/ontology.yaml (8-domain systems model, typed relationships, node lifecycle), and OIKOS.md (OODA loop operating brief, linked from AGENTS.md). Extends inventory.yaml with a stable service contract (doc_page, config_repo, risk_notes) on all 17 services, and a structured archaeology: section for the 13 destroyed LXCs (was scattered comments + a narrative table). Fixes stale drift found in the process: authentik's backend pointed at a retired LXC (124); core has run on the VPS since 2026-05-31. Adds oikos/gen-topology.py, generating infrastructure/topology.md (Mermaid compute/ingress + storage views) from inventory.yaml. build_host_files.py now carries state/storage/depends_on into generated hosts/*.yaml. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
# Generated by mcp/build_host_files.py from inventory.yaml.
|
|
# Do NOT edit by hand — your changes will be overwritten.
|
|
# Source of truth: ../inventory.yaml
|
|
name: netbird-vps
|
|
kind: external
|
|
os: linux
|
|
role: netbird-mgmt
|
|
state: active
|
|
mesh:
|
|
netbird:
|
|
ip: 100.122.165.149
|
|
fqdn: netbird-ionos.netbird.selfhosted
|
|
mesh_globals:
|
|
primary: netbird
|
|
accepted:
|
|
- netbird
|
|
- tailscale
|
|
ssh:
|
|
user: root
|
|
runs:
|
|
- authentik
|
|
services_hosted:
|
|
- name: authentik
|
|
url: https://auth.hubris.network
|
|
backend: netbird-vps
|
|
doc_page: containers/106-auth-outpost.md
|
|
note: core runs on the VPS since 2026-05-31; LAN forward-auth outpost is auth-outpost (LXC 106) at 192.168.8.6:9000.
|
|
Previous backend value "authentik" referenced the retired embedded-outpost host (LXC 124).
|
|
risk_notes: "SSO provider \u2014 outage locks login to OIDC/forward-auth services"
|
|
notes:
|
|
- "Public IONOS VPS \u2014 hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see\
|
|
\ infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21)."
|
|
- NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris;
|
|
sshd is locked to hubris's pubkey.
|
|
- Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
|
|
- Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl,
|
|
with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on
|
|
hubris.
|
|
mcp_endpoint: https://mcp.hubris.network/mcp
|
|
secrets_issuance_endpoint: https://secrets.hubris.network/issue
|