dongarandClaude Opus 5.5
eafe1b9f4a
deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and SilverBullet over it: the operator writes the vault, the agents' memory/ is read-only to it, and only the operator's Caddy reaches it, which serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and checks it from here. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
The agent host
nisse-host.garrett-hall.com, made by infra/tofu#77 (architecture X1). For now
it holds the knowledge vault and SilverBullet, the operator's view of it (L10,
M5.4). The agents' containers come later (M6.1).
What's here
silverbullet/compose.yaml: SilverBullet, its version pinned. It mounts the vault, with the agents'memory/read-only, and its own data folder. Nothing else of the host.setup.sh: makes the vault's folders, installs the stack under/opt/stacks/silverbulletand the firewall, and starts it. Safe to run again.nisse-firewall: only the operator's Caddy may reach SilverBullet's port (Docker'sDOCKER-USERchain, re-applied whenever Docker starts).caddy/vault.dongar.net.caddy: the site for the operator's Caddy ondocker.garrett-hall.com. HTTPS from Caddy's usual certificate, LAN only.
The vault
/srv/nisse/vault, one copy on the host's disk, nothing synced:
- The operator's: the root and everything in it but
memory/, written through SilverBullet.infrastructure/holds material fornisse-ops, whichnisse-devwill never be given. - The agents':
memory/<agent>/, one writer each, when the agents move in. SilverBullet sees them read-only.
Backed up nightly with the VM (Proxmox; backup: true in infra/tofu).
Installing and checking
From the development VM, with the bring-up key the operator added for ubuntu:
scripts/agent-host.sh install # copy this folder over and run setup.sh
scripts/agent-host.sh check # running, mounts, firewall
Then:
- The operator adds the Caddy site from
caddy/vault.dongar.net.caddyand reloads Caddy. - The operator runs SilverBullet's setup wizard at once, at
https://vault.dongar.net. Until it's done, whoever opens the page first makes the administrator account.- Account: the operator's, with a strong password.
- Space: folder
/vault, addressvault.dongar.net, path/.