dtoro
21063015c7
Three coordinated changes addressing follow-ups from the 2026-05-21 netbird vanilla
migration, plus a related off-LAN ergonomics fix:
bin/homelab:
- New ssh_target(name, force_mesh=False) helper resolves (addr, port, user)
from inventory, honoring ssh.netbird_port (forces mesh path) and ssh.user
(default "root"). Falls back to the netbird FQDN when LAN IP fails a
cached 1.5s TCP probe — helps off-LAN operators on VPN/symmetric-NAT
paths where the netbird subnet route doesn't reach 192.168.8.0/24.
- New ssh_base() builds the full `ssh ... user@addr` invocation; hubris_ssh()
is now a back-compat shim. cmd_ssh, cmd_logs, cmd_restart, cmd_nuke
refactored to use it — no more hardcoded "root@" anywhere.
inventory.yaml:
- New ssh.user convention (root by default, explicit per workstation).
- hubris.ssh.user=root (explicit, documents convention).
- republic-laptop, mac-mini: ssh.user=dtoro. ludo-mini left default (TODO).
- Comment block in the header explains the field + why it exists (netbird-ssh
defaults to LOCAL username; "user not found" on LXCs is the gotcha).
- hosts/*.yaml regenerated from build_host_files.py.
infrastructure/mesh.md:
- Migration changelog entry updated: Device Code Stage is now configured
(was "NOT yet" — landed in d41d73f); --setup-key no longer required.
- New subsection documenting the post-migration JWT-issuer cache bug:
client/internal/engine_ssh.go's updateSSH() bails out when sshServer is
already running, so systemctl restart and netbird down/up don't refresh
the SSH JWT validator. Full daemon stop/start is the fix.
- Companion username gotcha (`netbird ssh` defaulting to local username).
operations/agent-enrollment.md:
- Three new troubleshooting rows: JWT-issuer cache, user-not-found, and
LAN-unreachable-from-mesh-peer (the new homelab CLI behavior).
Verification: ssh_target resolution against the live inventory yields
- hubris → ssh -p 22022 root@proxmox-server.netbird.selfhosted (mesh-forced)
- jellyfin/gitea → ssh root@192.168.8.x (LAN reachable, probe passed)
- republic-laptop/mac-mini → ssh dtoro@<fqdn> (per ssh.user)
- ludo-mini → ssh root@<fqdn> (default)
Homelab Wiki — hubris
Living documentation for the hubris Proxmox homelab. Every node, every cross-cutting system, and every meaningful incident is its own page; pages are linked so you can start anywhere and walk the graph.
Last refreshed against live state: 2026-04-28.
Map
Hosts
hubris— single Proxmox VE node, GMKtec NucBox M6 Ultra,192.168.8.77
VMs
- 100 —
zimaos— ZimaOS 1.6.1, NAS frontend (evaluation) - 108 —
haos-16.3— Home Assistant OS
LXC containers
See the full table in containers/index.md. Quick links:
| ID | Name | IP | Role |
|---|---|---|---|
| 101 | jellyfin | 192.168.8.206 | Media server |
| 102 | nfs-export | 192.168.8.200 | NFSv4 re-export of /mnt/library for ZimaOS |
| 103 | paperless | 192.168.8.130 | Document mgmt |
| 104 | gitea | 192.168.8.121 | Git server |
| 105 | apps | 192.168.8.205 | Docker host (Artifacto / Booklore / PlantUML / Portainer / WriteFreely) |
| 114 | nextcloud | 192.168.8.224 | Personal cloud |
| 118 | elementsynapse | 192.168.8.239 | Matrix Synapse |
| 119 | sophia | 192.168.8.157 | Sophia |
| 120 | mule-images | 192.168.8.136 | Mule-image / mulita photos |
| 121 | caddy | 192.168.8.175 | Reverse proxy |
| 122 | arriman | 192.168.8.132 | Docker host (*arr stack) |
| 123 | claudio-bot | 192.168.8.230 | Matrix control plane |
| 124 | authentik | 192.168.8.180 | SSO + split-horizon DNS |
| 126 | plato | 192.168.8.190 | Plato (notes/discovery workspace) |
Cross-cutting infrastructure
- DNS — split-horizon
- Ingress — Caddy + VPS traefik
- Mesh — Tailscale → Netbird migration
- Monitoring — claudio-monitor
- Media permissions —
mediaGID 10000 - SSH access
- Backups — restic on external drive (disabled)
- Auto-deploy — gitea-webhook pipelines
- VPS hardening — IONOS / netbird control plane
- Homelab context distribution — cross-client
/opt/homelab-context+ MCP + secrets-issuance
Investigations
Time-stamped incident notes / experiments in investigations/.
Operations
- Command cheatsheet
- Agent enrollment — bootstrap a new client (workstation, LXC, VM) into the homelab context system
Conventions
- Each node page ends with a
## Changelogsection. Reverse-chronological. Entry format:### YYYY-MM-DD — short title one or two lines on what changed and why. - Cross-linking is mandatory. If a page references another node or system, link to it. Treat orphans as a bug.
- Live state wins. When something here disagrees with
pct config/docker inspect/ running config, fix the wiki and note the change in the relevant changelog. - Tracked configs. A node whose config lives in a Gitea repo (Caddy, Gitea customizations, Artifacto, mule-image, claudio-bot) is auto-deployed via webhook — see auto-deploy. Edits there must be pushed, not left local.
- No secrets. This is a private repo on
git.hubris.network, but still: paths to secret files are fine, secret values are not.
Maintaining this wiki
When you change a node:
- Update the relevant page (config snapshot, ports, mounts).
- Add a changelog entry at the bottom of that page.
- If the change touches a cross-cutting system (DNS, Caddy, Authentik, mesh), update that page too and link it from the changelog entry.
- If it's an incident, add an entry to
investigations/.
See also
CONTRIBUTING.md— page templates and tone