dtoro
b5c1247093
Problem: after the wiki-hq reorg, agent-instruction and human-doc domains were still scattered across the repo root, with three now-redundant stub files cluttering it. The organizing principle wasn't visible in the layout. Change — enforce three clear buckets: - .agents/ = how agents operate: OIKOS.md, HERMES.md (moved from root), shared/ conventions, domains/ schemas, skills/, and operations/ (operator cheatsheet + enrollment + hermes-agent, moved from root). - knowledge/ = what exists + evidence: wiki/, GLOSSARY.md, and sources/ now including investigations/ (incident records are evidence/sources). - root = substrate + two entry points (AGENTS.md, README.md), plus plans/ as its own design-intent domain. Moves: - investigations/ -> knowledge/sources/investigations/ (incl. archive/, index). - operations/ -> .agents/operations/. - HERMES.md -> .agents/HERMES.md. - Deleted unreferenced root stubs CAVEMAN.md, CONTRIBUTING.md, and OIKOS.md (its 7 remaining linkers repointed to .agents/OIKOS.md). Consumers updated: - inventory.yaml doc_page (agent-enrollment) + regenerated hosts/*.yaml + cards. - tools/setup-hermes-soul.sh and bootstrap.sh (x2) -> .agents/HERMES.md. - bin/homelab help string -> .agents/operations/hermes-agent.md. - knowledge/operations schemas, llm-wiki, page-templates, incident-investigation skill, AGENTS.md/README nav -> new investigations/operations paths. - All markdown links rewritten via the path-resolving mapper. Left in place (substrate/executable/separate-domain): hosts/, ledger/, tools/, plans/, oikos/, mcp/, secrets/, bin/, inventory.yaml. Verification: docs-lint at baseline (2 intentional cross-repo refs, no new breakage); gen-topology.py --check exit 0; build_host_files.py idempotent; all doc_page targets resolve; Hermes provisioning scripts point at the new path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
63 lines
3.1 KiB
Markdown
63 lines
3.1 KiB
Markdown
# 131 — `teddycloud`
|
|
|
|
Self-hosted [TeddyCloud](https://github.com/toniebox-reverse-engineering/teddycloud), a
|
|
reimplementation of the Toniebox cloud backend — lets Tonie figurines play custom/ripped
|
|
audio content against a local server instead of the official cloud.
|
|
|
|
Predates the client-enrollment convention entirely; nobody wrote it down. Found and
|
|
documented on 2026-07-06 after Oikos's drift detector (`oikos/drift.py`) flagged
|
|
`pve_id 131` as live on hubris (via `pct list`) with no `inventory.yaml` entry — see
|
|
[OIKOS.md](../../../.agents/OIKOS.md)'s Week 3 build-status note. `containers/132-rclone.md` had already
|
|
mentioned it in passing ("LXC 131 was already taken by an undocumented `teddycloud`
|
|
container"), and `hosts/strong.md`'s 2026-07-05 migration changelog fixed a DHCP conflict
|
|
for it — but it never got its own inventory entry or doc page until now.
|
|
|
|
## At a glance
|
|
|
|
- **Hostname:** `teddycloud`
|
|
- **Host:** hubris (confirmed via `pct config 131` run directly on hubris — the original
|
|
drift finding's `pct list` source)
|
|
- **IP:** `192.168.8.150` (static; was briefly `192.168.8.243` via DHCP until the
|
|
2026-07-05 strong-migration work assigned it a fixed address — see hosts/strong.md)
|
|
- **Privilege:** unconfirmed (not checked — read-only investigation didn't need it)
|
|
- **Resources:** 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (`local-lvm`), Debian 12
|
|
(bookworm)
|
|
- **Mounts:** `/mnt/library` (`mp0`)
|
|
- **Public hostname:** `teddy.hubris.network` → `192.168.8.150:8443` (see
|
|
[caddy (121)](121-caddy.md))
|
|
- **Enrollment:** none — no `age_pubkey`, not a `homelab` CLI client. It's a plain
|
|
docker-compose app container, not a fleet-managed host. No action needed unless it starts
|
|
needing secrets.
|
|
|
|
## Service
|
|
|
|
Runs via `docker compose` at `/opt/teddycloud` — container `teddycloud-teddycloud-1`,
|
|
image `ghcr.io/toniebox-reverse-engineering/teddycloud:latest`, publishing `80`, `443`,
|
|
`8080`, and `8443`. Caddy routes `teddy.hubris.network` to the `:8443` port.
|
|
|
|
## Risk notes
|
|
|
|
**No Caddy forward-auth gate** — unlike `sab.hubris.network` on the same Caddyfile (which
|
|
is explicitly annotated `(Authentik forward-auth)`), `teddy.hubris.network` has no auth
|
|
annotation. It's reachable to anyone on the LAN/mesh who can resolve the hostname. Not
|
|
addressed as part of this doc pass — flagging it here since it's now visible in one place
|
|
for the first time.
|
|
|
|
## Related
|
|
|
|
- [Hubris host](../hosts/hubris.md)
|
|
- [Caddy (121)](121-caddy.md) — terminates `teddy.hubris.network`
|
|
- [rclone (132)](132-rclone.md) — landed on pve_id 132 specifically because 131 was already
|
|
taken by this container
|
|
- [Containers index](index.md)
|
|
- [OIKOS.md](../../../.agents/OIKOS.md) — drift detector that caught this
|
|
|
|
## Changelog
|
|
|
|
### 2026-07-06 — documented for the first time (drift-caught)
|
|
|
|
Added to `inventory.yaml` and given this page. Verified live via read-only `pct config 131`
|
|
+ `pct exec 131 -- ...` on hubris: hostname, IP, resources, and that it runs via
|
|
`docker compose` (not a raw binary or systemd unit). No changes made to the running
|
|
container — this is pure documentation catch-up.
|