# The agent host

`nisse.garrett-hall.com`, made by infra/tofu#77 as `nisse-host` and since
renamed (architecture X1). For now it holds the knowledge vault and
SilverBullet, the operator's view of it (L10, M5.4). The agents' containers come
later (M6.1).

## What's here

- `silverbullet/compose.yaml`: SilverBullet, its version pinned, serving the
  vault as its one space, with the agents' `memory/` read-only. Nothing else of
  the host. It has no accounts: the operator logs in through Authelia.
- `setup.sh`: makes the vault's folders, installs the stack under
  `/opt/stacks/silverbullet` and the firewall, and starts it. Safe to run again.
- `nisse-firewall`: only the operator's Caddy may reach SilverBullet's port
  (Docker's `DOCKER-USER` chain, re-applied whenever Docker starts).
- `check.sh`: run on the host by `scripts/agent-host.sh check`; says "all
  checks passed" only once every check has run.
- `caddy/nisse-memory.dongar.net.caddy`: the site for the operator's Caddy on
  `docker.garrett-hall.com`. HTTPS from Caddy's usual certificate,
  behind Authelia.

## The vault

`/srv/nisse/vault`, one copy on the host's disk, nothing synced:

- **The operator's:** the root and everything in it but `memory/`, written
  through SilverBullet. `infrastructure/` holds material for `nisse-ops`, which
  `nisse-dev` will never be given.
- **The agents':** `memory/<agent>/`, one writer each, when the agents move in.
  SilverBullet sees them read-only.

Backed up nightly with the VM (Proxmox; `backup: true` in infra/tofu).

## Installing and checking

From the development VM, with the bring-up key the operator added for `ubuntu`:

```sh
scripts/agent-host.sh install   # copy this folder over and run setup.sh
scripts/agent-host.sh check     # running, mounts, firewall
```

Then **the operator adds the Caddy site** from
`caddy/nisse-memory.dongar.net.caddy`, behind Authelia, and reloads Caddy.
There's no setup wizard: SilverBullet starts serving the vault at once.

**Making `memory/` writable for a while** (for example, to upload material that
will be sorted into the agents' folders): on the host, add
`/opt/stacks/silverbullet/compose.override.yaml` that replaces the volumes with
the vault alone (`volumes: !override [/srv/nisse/vault:/data]`), give `memory/`
to uid 1000, and `docker compose up -d`. `check` fails while it's in place.
To end it, delete the override and run `install` again, which gives `memory/`
back to root.