dongarandClaude Opus 5.5
5ab0861e8e
The check went to the host on stdin, and the first docker compose exec read the rest of it: the memory and firewall checks never ran, and it passed. It is now its own file, sent as an argument, and ends with "all checks passed" only when every check has run. Tests fake the host with a docker that reads stdin. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# The agent host
|
|
|
|
`nisse.garrett-hall.com`, made by infra/tofu#77 as `nisse-host` and since
|
|
renamed (architecture X1). For now it holds the knowledge vault and
|
|
SilverBullet, the operator's view of it (L10, M5.4). The agents' containers come
|
|
later (M6.1).
|
|
|
|
## What's here
|
|
|
|
- `silverbullet/compose.yaml`: SilverBullet, its version pinned. It mounts the
|
|
vault, with the agents' `memory/` read-only, and its own data folder.
|
|
Nothing else of the host.
|
|
- `setup.sh`: makes the vault's folders, installs the stack under
|
|
`/opt/stacks/silverbullet` and the firewall, and starts it. Safe to run again.
|
|
- `nisse-firewall`: only the operator's Caddy may reach SilverBullet's port
|
|
(Docker's `DOCKER-USER` chain, re-applied whenever Docker starts).
|
|
- `check.sh`: run on the host by `scripts/agent-host.sh check`; says "all
|
|
checks passed" only once every check has run.
|
|
- `caddy/vault.dongar.net.caddy`: the site for the operator's Caddy on
|
|
`docker.garrett-hall.com`. HTTPS from Caddy's usual certificate, LAN only.
|
|
|
|
## The vault
|
|
|
|
`/srv/nisse/vault`, one copy on the host's disk, nothing synced:
|
|
|
|
- **The operator's:** the root and everything in it but `memory/`, written
|
|
through SilverBullet. `infrastructure/` holds material for `nisse-ops`, which
|
|
`nisse-dev` will never be given.
|
|
- **The agents':** `memory/<agent>/`, one writer each, when the agents move in.
|
|
SilverBullet sees them read-only.
|
|
|
|
Backed up nightly with the VM (Proxmox; `backup: true` in infra/tofu).
|
|
|
|
## Installing and checking
|
|
|
|
From the development VM, with the bring-up key the operator added for `ubuntu`:
|
|
|
|
```sh
|
|
scripts/agent-host.sh install # copy this folder over and run setup.sh
|
|
scripts/agent-host.sh check # running, mounts, firewall
|
|
```
|
|
|
|
Then:
|
|
|
|
1. **The operator adds the Caddy site** from `caddy/vault.dongar.net.caddy`
|
|
and reloads Caddy.
|
|
2. **The operator runs SilverBullet's setup wizard at once,** at
|
|
`https://vault.dongar.net`. Until it's done, whoever opens the page first
|
|
makes the administrator account.
|
|
- Account: the operator's, with a strong password.
|
|
- Space: folder `/vault`, address `vault.dongar.net`, path `/`.
|