dtoro
25c67a79c6
Pushed dtoro/caddy-conf@c195142: oikos.hubris.network -> 192.168.8.205:8091, Authentik-gated (matches paperless.hubris.network's live pattern — confirmed exact snippet syntax against the real Caddyfile rather than trusting the paraphrase in the original README, which turned out to have the wrong forward_auth target: the live snippet points at 127.0.0.1:8099 on Caddy's own LXC, not 192.168.8.6:9000 as containers/106-auth-outpost.md's older text suggested). Reload verified clean — an unrelated existing route stayed healthy through it. Found and fixed a real deploy-blocking bug in the process: oikos-console.service bound 127.0.0.1 only, but Caddy runs on a different host (121) and can only reach apps (105) over the LAN — the console would have been completely unreachable once deployed. Now binds 0.0.0.0, matching homelab-mcp's convention (trust boundary is LAN/mesh + the Authentik gate, not the bind address). Encountered and deliberately left alone: a pre-existing local clone at /tmp/caddy-conf with an unpushed commit + uncommitted diff about jellyfin's auth gating, from before this clone fell 12 commits behind origin. That work turned out to be superseded (origin already reached the same conclusion — SSO plugin handles jellyfin auth, no forward-auth gate — via a different, already-merged path). Didn't touch it; used a fresh clone instead to avoid any risk of losing or corrupting that state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Homelab Wiki — hubris
Living documentation for the hubris Proxmox homelab. Every node, every cross-cutting system, and every meaningful incident is its own page; pages are linked so you can start anywhere and walk the graph.
Last refreshed against live state: 2026-07-06.
Quick navigation
- Proxmox hosts — hubris (primary) + strong (cluster member)
- VMs — ZimaOS, Home Assistant
- LXC containers — service fleet (17 containers)
- Cross-cutting infrastructure — DNS, ingress, mesh, storage, auth
- Investigations — incident timelines
- Operations — cheatsheet, enrollment, runbooks
- Glossary — term definitions
- Conventions — wiki style, changelog hygiene, same-session update rule
Map
Proxmox hosts
hubris— PVE node, GMKtec NucBox M6 Ultra,192.168.8.77— primary host, runs 8 LXCs + 2 VMsstrong— PVE node (cluster hostnamestrong),192.168.178.181— 2nd member ofHomelabcluster. Hosts 7 LXCs migrated from hubris (Phase 1+2, 2026-07-05)
VMs
- 100 —
zimaos— ZimaOS 1.6.1, NAS frontend (evaluation) - 108 —
haos-16.3— Home Assistant OS - See vms/index.md for the full table
LXC containers
See the full table with IPs, hosts, mounts, and status in
containers/index.md. Quick summary:
- hubris (10 active): 102 nfs-export, 103 paperless, 104 gitea, 105 apps, 114 nextcloud, 119 sophia, 120 mule-images, 121 caddy, 124 authentik (outpost), 128 trmnl, 132 rclone
- strong (7 active): 101 jellyfin, 118 elementsynapse, 122 arriman, 129 house, 130 grimmory, 133 seanime, 134 romm
- Destroyed (archaeology): 100 arr, 106 flaresolverr, 107 marimo, 109 syncthing, 110 photoprism, 111 karakeep, 112 immich, 115 reticulum, 123 claudio-bot, 125 seafile, 126 plato, 127 mule-photos-new — see containers/index.md
Cross-cutting infrastructure
- Infrastructure index — map of every cross-cutting system
- Glossary — term definitions
- DNS — split-horizon
- Ingress — Caddy + VPS traefik
- Mesh — Tailscale → Netbird migration
- Monitoring — Hermes health watchdog
- Media permissions —
mediaGID 10000 - SSH access
- Backups — rclone → Proton Drive (LXC 132); restic-on-USB deprecated
- Auto-deploy — gitea-webhook pipelines
- VPS hardening — IONOS / netbird control plane
- Homelab context distribution — cross-client
/opt/homelab-context+ MCP + secrets-issuance
Investigations
Time-stamped incident notes / experiments in investigations/index.md.
Resolved cases move to investigations/archive/.
Operations
- Command cheatsheet
- Agent enrollment — bootstrap a new client (workstation, LXC, VM) into the homelab context system
Conventions
- Each node page ends with a
## Changelogsection. Reverse-chronological. Entry format:### YYYY-MM-DD — short title one or two lines on what changed and why. - Cross-linking is mandatory. If a page references another node or system, link to it. Treat orphans as a bug.
- Live state wins. When something here disagrees with
pct config/docker inspect/ running config, fix the wiki and note the change in the relevant changelog. - Tracked configs. A node whose config lives in a Gitea repo (Caddy, Gitea customizations, Artifacto, mule-image) is auto-deployed via webhook — see auto-deploy. Edits there must be pushed, not left local.
- No secrets. This is a private repo on
git.hubris.network, but still: paths to secret files are fine, secret values are not.
Maintaining this wiki
When you change a node:
- Update the relevant page (config snapshot, ports, mounts).
- Add a changelog entry at the bottom of that page.
- If the change touches a cross-cutting system (DNS, Caddy, Authentik, mesh), update that page too and link it from the changelog entry.
- If it's an incident, add an entry to
investigations/.
See also
CONTRIBUTING.md— page templates and tone