The agent host's vault and SilverBullet (M5.4)

deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and
SilverBullet over it: the operator writes the vault, the agents' memory/
is read-only to it, and only the operator's Caddy reaches it, which
serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and
checks it from here.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/README.md

@@ -0,0 +1,48 @@
+# The agent host
+
+`nisse-host.garrett-hall.com`, made by infra/tofu#77 (architecture X1). For now
+it holds the knowledge vault and SilverBullet, the operator's view of it (L10,
+M5.4). The agents' containers come later (M6.1).
+
+## What's here
+
+- `silverbullet/compose.yaml`: SilverBullet, its version pinned. It mounts the
+  vault, with the agents' `memory/` read-only, and its own data folder.
+  Nothing else of the host.
+- `setup.sh`: makes the vault's folders, installs the stack under
+  `/opt/stacks/silverbullet` and the firewall, and starts it. Safe to run again.
+- `nisse-firewall`: only the operator's Caddy may reach SilverBullet's port
+  (Docker's `DOCKER-USER` chain, re-applied whenever Docker starts).
+- `caddy/vault.dongar.net.caddy`: the site for the operator's Caddy on
+  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, LAN only.
+
+## The vault
+
+`/srv/nisse/vault`, one copy on the host's disk, nothing synced:
+
+- **The operator's:** the root and everything in it but `memory/`, written
+  through SilverBullet. `infrastructure/` holds material for `nisse-ops`, which
+  `nisse-dev` will never be given.
+- **The agents':** `memory/<agent>/`, one writer each, when the agents move in.
+  SilverBullet sees them read-only.
+
+Backed up nightly with the VM (Proxmox; `backup: true` in infra/tofu).
+
+## Installing and checking
+
+From the development VM, with the bring-up key the operator added for `ubuntu`:
+
+```sh
+scripts/agent-host.sh install   # copy this folder over and run setup.sh
+scripts/agent-host.sh check     # running, mounts, firewall
+```
+
+Then:
+
+1. **The operator adds the Caddy site** from `caddy/vault.dongar.net.caddy`
+   and reloads Caddy.
+2. **The operator runs SilverBullet's setup wizard at once,** at
+   `https://vault.dongar.net`. Until it's done, whoever opens the page first
+   makes the administrator account.
+   - Account: the operator's, with a strong password.
+   - Space: folder `/vault`, address `vault.dongar.net`, path `/`.