# The agent host

`nisse.garrett-hall.com`, made by infra/tofu#77 as `nisse-host` and since
renamed (architecture X1). For now it holds the knowledge vault and
SilverBullet, the operator's view of it (L10, M5.4). The agents' containers come
later (M6.1).

## What's here

- `silverbullet/compose.yaml`: SilverBullet, its version pinned. It mounts the
  vault, with the agents' `memory/` read-only, and its own data folder.
  Nothing else of the host.
- `setup.sh`: makes the vault's folders, installs the stack under
  `/opt/stacks/silverbullet` and the firewall, and starts it. Safe to run again.
- `nisse-firewall`: only the operator's Caddy may reach SilverBullet's port
  (Docker's `DOCKER-USER` chain, re-applied whenever Docker starts).
- `caddy/vault.dongar.net.caddy`: the site for the operator's Caddy on
  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, LAN only.

## The vault

`/srv/nisse/vault`, one copy on the host's disk, nothing synced:

- **The operator's:** the root and everything in it but `memory/`, written
  through SilverBullet. `infrastructure/` holds material for `nisse-ops`, which
  `nisse-dev` will never be given.
- **The agents':** `memory/<agent>/`, one writer each, when the agents move in.
  SilverBullet sees them read-only.

Backed up nightly with the VM (Proxmox; `backup: true` in infra/tofu).

## Installing and checking

From the development VM, with the bring-up key the operator added for `ubuntu`:

```sh
scripts/agent-host.sh install   # copy this folder over and run setup.sh
scripts/agent-host.sh check     # running, mounts, firewall
```

Then:

1. **The operator adds the Caddy site** from `caddy/vault.dongar.net.caddy`
   and reloads Caddy.
2. **The operator runs SilverBullet's setup wizard at once,** at
   `https://vault.dongar.net`. Until it's done, whoever opens the page first
   makes the administrator account.
   - Account: the operator's, with a strong password.
   - Space: folder `/vault`, address `vault.dongar.net`, path `/`.