nisse/deploy/agent-host/README.md

The agent host

nisse.garrett-hall.com, made by infra/tofu#77 as nisse-host and since renamed (architecture X1). For now it holds the knowledge vault and SilverBullet, the operator's view of it (L10, M5.4). The agents' containers come later (M6.1).

What's here

• silverbullet/compose.yaml: SilverBullet, its version pinned. It mounts the vault, with the agents' memory/ read-only, and its own data folder. Nothing else of the host.
• setup.sh: makes the vault's folders, installs the stack under /opt/stacks/silverbullet and the firewall, and starts it. Safe to run again.
• nisse-firewall: only the operator's Caddy may reach SilverBullet's port (Docker's DOCKER-USER chain, re-applied whenever Docker starts).
• caddy/vault.dongar.net.caddy: the site for the operator's Caddy on docker.garrett-hall.com. HTTPS from Caddy's usual certificate, LAN only.

The vault

/srv/nisse/vault, one copy on the host's disk, nothing synced:

• The operator's: the root and everything in it but memory/, written through SilverBullet. infrastructure/ holds material for nisse-ops, which nisse-dev will never be given.
• The agents': memory/<agent>/, one writer each, when the agents move in. SilverBullet sees them read-only.

Backed up nightly with the VM (Proxmox; backup: true in infra/tofu).

Installing and checking

From the development VM, with the bring-up key the operator added for ubuntu:

scripts/agent-host.sh install   # copy this folder over and run setup.sh
scripts/agent-host.sh check     # running, mounts, firewall

Then:

1. The operator adds the Caddy site from caddy/vault.dongar.net.caddy and reloads Caddy.
2. The operator runs SilverBullet's setup wizard at once, at https://vault.dongar.net. Until it's done, whoever opens the page first makes the administrator account.
   • Account: the operator's, with a strong password.
   • Space: folder /vault, address vault.dongar.net, path /.