dev/nisse

1 Fork 0

Files

T

History

dongarandClaude Opus 5.5 5ab0861e8e

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 2m7s

Details

CI / e2e (pull_request) Successful in 3m59s

Details

Agent host check: run every step, and say so

The check went to the host on stdin, and the first docker compose exec read
the rest of it: the memory and firewall checks never ran, and it passed.
It is now its own file, sent as an argument, and ends with "all checks
passed" only when every check has run. Tests fake the host with a docker
that reads stdin.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

2026-10-19 14:48:31 +00:00

caddy

Agent host: the VM is now nisse, not nisse-host

2026-10-19 13:08:06 +00:00

silverbullet

The agent host's vault and SilverBullet (M5.4)

2026-10-18 20:55:21 +00:00

check.sh

Agent host check: run every step, and say so

2026-10-19 14:48:31 +00:00

nisse-firewall

The agent host's vault and SilverBullet (M5.4)

2026-10-18 20:55:21 +00:00

README.md

Agent host check: run every step, and say so

2026-10-19 14:48:31 +00:00

setup.sh

The agent host's vault and SilverBullet (M5.4)

2026-10-18 20:55:21 +00:00

README.md

The agent host

nisse.garrett-hall.com, made by infra/tofu#77 as nisse-host and since renamed (architecture X1). For now it holds the knowledge vault and SilverBullet, the operator's view of it (L10, M5.4). The agents' containers come later (M6.1).

What's here

silverbullet/compose.yaml: SilverBullet, its version pinned. It mounts the vault, with the agents' memory/ read-only, and its own data folder. Nothing else of the host.
setup.sh: makes the vault's folders, installs the stack under /opt/stacks/silverbullet and the firewall, and starts it. Safe to run again.
nisse-firewall: only the operator's Caddy may reach SilverBullet's port (Docker's DOCKER-USER chain, re-applied whenever Docker starts).
check.sh: run on the host by scripts/agent-host.sh check; says "all checks passed" only once every check has run.
caddy/vault.dongar.net.caddy: the site for the operator's Caddy on docker.garrett-hall.com. HTTPS from Caddy's usual certificate, LAN only.

The vault

/srv/nisse/vault, one copy on the host's disk, nothing synced:

The operator's: the root and everything in it but memory/, written through SilverBullet. infrastructure/ holds material for nisse-ops, which nisse-dev will never be given.
The agents': memory/<agent>/, one writer each, when the agents move in. SilverBullet sees them read-only.

Backed up nightly with the VM (Proxmox; backup: true in infra/tofu).

Installing and checking

From the development VM, with the bring-up key the operator added for ubuntu:

scripts/agent-host.sh install   # copy this folder over and run setup.sh
scripts/agent-host.sh check     # running, mounts, firewall

Then:

The operator adds the Caddy site from caddy/vault.dongar.net.caddy and reloads Caddy.
The operator runs SilverBullet's setup wizard at once, at https://vault.dongar.net. Until it's done, whoever opens the page first makes the administrator account.
- Account: the operator's, with a strong password.
- Space: folder /vault, address vault.dongar.net, path /.