oikos/.agents/operations/commands.md

Operations cheatsheet

Run from the hubris host as root. When working from /root on Linux you're already on hubris — don't ssh hubris / ping hubris.

Proxmox CLI

Command	Use
pct list / qm list	List LXC containers / VMs
pct config <id> / qm config <id>	Container / VM config
pct exec <id> -- <cmd>	Run command inside an LXC without entering it (no initgroups — see media permissions)
pct enter <id>	Shell into a container
pct start <id> / pct stop <id>	Boot / halt a container
pvesm status	Storage pools status
pvesh get /nodes --output-format json	Node summary as JSON
pvesh get /nodes/hubris/lxc/<id>/status/current	Live container status
pvesh get /cluster/resources --type vm --output-format json	Bulk per-LXC CPU/mem/disk (used by the homelab-health-watchdog Nomos cron — see monitoring; the old claudio-monitor this once fed is deprecated)
pveversion	PVE version
journalctl -u pve-cluster -n 100	PVE service logs

Storage

• Shared mount: /mnt/library (ext4 on lvmthin library).
• Bind into a container: pct set <id> -mp<N> /mnt/library/<sub>,mp=/data
• For the standard whole-tree mount: pct set <id> -mp0 /mnt/library,mp=/mnt/library. See media permissions for the GID-10000 onboarding recipe.

Reverse proxy

• Caddyfile: /etc/caddy/Caddyfile on LXC 121.
• CRITICAL: This file is tracked in dtoro/caddy-conf (https://git.hubris.network/dtoro/caddy-conf). Never edit it directly on the LXC — commit + push to the repo instead. Caddy auto-deploys on push (see auto-deploy). If you edit directly, the change will be lost on the next pull and agents won't know about it.
• Hot reload: pct exec 121 -- systemctl reload caddy.
• Validate: pct exec 121 -- caddy validate --config /etc/caddy/Caddyfile.
• Git workflow shortcut: pct exec 121 -- "cd /etc/caddy && git add Caddyfile && git commit -m '...' && git push".

DNS

• Split-horizon authority: Technitium DNS on dns (107) at 192.168.8.2:53. Web UI at http://192.168.8.2. (Formerly dnsmasq on the now-destroyed LXC 124 — decommissioned 2026-06-04.)
• Add/edit records in the Technitium UI; the NetBird managed zone sync (scripts/dns-sync.py cron on 107) picks changes up within ~10 minutes.
• Verify: dig @192.168.8.2 +short <host>.hubris.network.
• See DNS.

Web access

• https://proxmox.hubris.network or https://192.168.8.77:8006 — Proxmox UI

Telemetry quick checks

• ras-mc-ctl --summary — summary of any RAS events (memory / PCIe AER / thermal) since boot
• ras-mc-ctl --errors — full event log
• cat /sys/devices/system/cpu/cpu0/cpufreq/energy_performance_preference — should be balance_power
• cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor — should be powersave
• ls /sys/fs/pstore/ /var/lib/systemd/pstore/ — panic traces from a previous crash (empty for pure hardware hangs — see investigation)

Fleet apt operations

No current CLI equivalent. homelab apt-audit/apt-upgrade (dpkg-state audit, fanned-out apt upgrade with pre-upgrade snapshots) were part of the retired Python homelab CLI and don't have a ported replacement — apt patching today is ad hoc run MCP tool calls per host, without the audit/snapshot/status wrapping this used to provide. If that wrapping is still wanted, it needs to be rebuilt (e.g. as a runbook driving run, or a new MCP tool) — see runbook-dpkg-interrupted for the dpkg-interrupted recovery procedure specifically.

Oikos (agent OS layer)

See OIKOS.md for the operating model. The homelab CLI this section used to document is retired; the actual current interface is the MCP tool catalog in AGENTS.md §3 plus the REST API. Closest current equivalents for what used to live here:

Old homelab command	Current equivalent
homelab service <name> explain|health|docs|log	MCP explain, get_service_status, tail_log, get_entity_knowledge
homelab node <name> relations	MCP get_blast_radius
homelab change preflight <service>	MCP preflight
homelab signal list|ack|resolve|mute	MCP get_signal_history, or REST POST /api/v1/signals/{id}/ack|resolve|mute (the control-room UI's Signals page wraps these)
homelab approval request|list|reply|check	REST GET/POST /api/v1/approvals* (Matrix-delivered via the notifier, or the control-room UI's Operations page)
homelab restart <service> --approval-id <id>	MCP run (policy-gated — auto-executes if read-only/reversible_low, otherwise queues for the same Matrix/UI approval)
homelab decide <action> <entity>	No direct equivalent — classification now happens inline inside run, not as a separate dry-run call

There is no separately-deployed "Oikos Console" anymore — the control-room SPA is the operator dashboard. It lives in its own repo (dtoro/oikos-web, local checkout ~/Projects/oikos-web) with its own deploy pipeline, publishing the same host port 8091 as before (Phase 1 of plans/2026-08-15-hexagonal-architecture.md).

Related

• Hubris host
• Containers index
• DNS
• Monitoring
• Auto-deploy
• Runbook: dpkg-interrupted recovery — what to do when apt got killed mid-transaction