Anthony/agent-estate-wiki
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

snapshot: preserve central wiki state 2026-08-15 (7 modified + 1 new file)

Browse Source
This commit is contained in:
Tony0410
2026-08-15 22:11:30 +08:00
commit 92e8028bb8
71 changed files with 9897 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/backups.md
+44
View File
@@ -0,0 +1,44 @@
---
title: Backups
type: infrastructure
status: active
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: medium
tags: [infrastructure, backups]
sources: [raw/configs/hermes-config-sanitized.txt]
---
# Backups
## Purpose
How Hermes's own configuration/state gets backed up, and what's missing.
## Current mechanism
- **`hermes backup` CLI** (verified via `hermes backup --help`): creates a zip of the entire Hermes config, skills, sessions, and data (excludes the hermes-agent codebase itself).
- `--quick` / `-q`: fast snapshot of just critical state (`config`, `state.db`, `.env`, `auth`, `cron`)
- `--label` / `-l`: label for a quick snapshot
- `--output` / `-o`: custom output path (default `~/hermes-backup-<timestamp>.zip`)
- **Config keys** (`updates:` section of `~/.hermes/config.yaml`):
- `pre_update_backup: false` — Hermes does **not** automatically back up before self-updates
- `backup_keep: 5` — retention count (applies to config.yaml.bak* rotation seen during updates, e.g. in [[runbooks/update-hermes-safely]])
- `non_interactive_local_changes: stash`
## Evidence on disk (2026-07-22)
- One manual full backup exists: `/home/hermes/hermes-backup-2026-07-22-180830.zip` (~235 MB), same day as wiki creation.
- `/home/hermes/wiki-personal-backups/` holds an earlier snapshot of the wiki itself (`SCHEMA.md`, `current-state.md`, `index.md`, `log.md` from 17:34, before later same-day wiki edits) — see [[runbooks/backup-wiki]].
- `/home/hermes/hermes-wiki/` exists but is empty — likely a staging/rename artifact from wiki setup, not an active backup target.
- A dedicated memory-backup script exists: `/home/hermes/.hermes/scripts/mnemosyne-backup.sh` — see [[systems/mnemosyne]].
## Known gaps
- **No scheduled backup job found:** `crontab -l -u hermes` returns empty, and no systemd timer references `hermes` or `backup`. The one full backup on disk appears to have been triggered manually, not on a schedule.
- `pre_update_backup: false` means an in-place `hermes update` will not auto-snapshot first — the manual step in [[runbooks/update-hermes-safely]] step 1 is currently the only safety net.
## Relevant runbooks
- [[runbooks/backup-wiki]]
- [[runbooks/update-hermes-safely]]
## Related
- [[systems/mnemosyne]]
- [[systems/hermes-agent]]
infrastructure/credentials-map.md
+43
View File
@@ -0,0 +1,43 @@
---
title: Credentials Map
type: infrastructure
status: active
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: medium
tags: [credentials, security, infrastructure]
sources: []
---
# Credentials Map
## Purpose
Document where credentials are stored and what service they belong to.
**No credential values are stored in this wiki.**
## Storage Locations
| Service | Credential Store | Location | Notes |
|---|---|---|---|
| Telegram Bot | Hermes config | `~/.hermes/config.yaml` | Not exposed in wiki |
| Discord Bot | Hermes config | `~/.hermes/config.yaml` | Not exposed in wiki |
| Email | Hermes config | `~/.hermes/config.yaml` |-connected via IMAP/SMTP |
| Mattermost | Hermes config | `~/.hermes/config.yaml` | Connected |
| CF Access (mcp-portal) | Hermes config | `~/.hermes/config.yaml` | Client ID + Secret |
| LiteLLM | Hermes config | `~/.hermes/config.yaml` | API key |
| OmniRoute | Hermes config | `~/.hermes/config.yaml` | API key |
| Anthropic | Hermes config/OAuth | `~/.hermes/` | `.anthropic_oauth.json` |
| API Vault | Hermes vault | via `hermes-api-vault` skill | Notion-backed vault |
| Huawei Cloud | Terraform state / config | Unverified | |
| GitHub | Hermes config / gh CLI | `~/.config/gh/` or `~/.hermes/` | Unverified |
## Rules
- Credentials never written to this wiki
- API vault is first-stop for any key lookup
- If vault lacks it, surface the gap to user — do not fabricate
## Related
- [[hosts]]
- [[model-providers]]
- [[messaging-integrations]]
infrastructure/docker-services.md
+60
View File
@@ -0,0 +1,60 @@
---
title: Docker Services
type: infrastructure
status: mixed
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: medium
tags: [docker, homelab, infrastructure]
sources: [raw/configs/hermes-config-sanitized.txt]
---
# Docker Services
## Purpose
Containerized services supporting Hermes and the homelab.
## Status
- Docker runtime **not available** on this host (`docker ps` returned unavailable)
- Compose files confirmed present but execution state unverified
## Confirmed Compose Files
| File | Path | Services |
|---|---|---|
| Hermes Agent | `/home/hermes/.hermes/hermes-agent/docker-compose.yml` | hermes, hermes-dashboard |
| Hermes WebUI | `/home/hermes/hermes-webui/docker-compose.yml` | webui |
| ReadLater | `/home/hermes/workspace/readlater/docker-compose.yml` | readlater, edge-tts, kokoro-tts |
| Steel Browser | `/root/steel-browser/docker-compose.yml` (CT201) | steel-browser-api, steel-browser-ui |
## Service Definitions (from compose files)
### hermes-agent
- **Images:** `hermes-agent`
- **Containers:** `hermes`, `hermes-dashboard`
- **Volumes:** present (paths unverified)
- **Environment:** present (values unverified — secrets redacted)
### hermes-webui
- **Ports:** present (specific ports unverified)
- **Volumes:** present
### readlater
- **Container:** `readlater`
- **Ports:** present
- **Volumes:** present
- **Dependencies:** `edge-tts` (travisvn/openai-edge-tts), `kokoro-tts` (ghcr.io/remsky/kokoro-fastapi-cpu:v0.2.1)
## Known Issues
- Docker runtime unavailable on inspection host — service state unknown
- Specific ports, volumes, and env vars not extracted from compose files during this pass
## Additional Services (CT201 runtipi)
- **Homepage** — Dashboard at port 8082 (Tailscale: `https://runtipi.kangaroo-eel.ts.net:8443/`)
- **Manager** — Web UI for Homepage at port 8084
- See [systems/homepage-dashboard.md](../systems/homepage-dashboard.md) for full docs
## Related
- [[docker-services]]
- [[infrastructure/hosts]]
infrastructure/domains-and-tunnels.md
+48
View File
@@ -0,0 +1,48 @@
---
title: Domains and Tunnels
type: infrastructure
status: active
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: high
tags: [infrastructure, network, cloudflare]
sources: [raw/configs/hermes-config-sanitized.txt]
---
# Domains and Tunnels
## Purpose
Where `martinwa.org` subdomains point, and how they reach internal services.
## How it works
- **Verified:** All `*.martinwa.org` public hostnames are served by a single `cloudflared` daemon running on **ct207 (webserver)**, tunnel name `ct207-tunnel` (ID `339a6757-5574-4723-a16c-da4769535caa`), config at `/etc/cloudflared/config.yml` on ct207.
- **Verified:** `cloudflared` is not installed on this host (ct460/hermes) — Hermes has no local tunnel process to manage or restart. Any tunnel-side incident (hostname down, wrong target) must be fixed on ct207, not here.
- Two other Cloudflare tunnels exist in the same account (`Cloudo`, `Ifttt-ssh-webhook`, `livinity-liv`) but are unrelated to Hermes/ct207 and out of scope for this page.
## Hostnames relevant to Hermes
| Hostname | Target | Notes |
|---|---|---|
| `hermes.martinwa.org` | `http://100.118.5.51:19119` | Public Hermes dashboard — nginx on ct460 proxies 19119→127.0.0.1:9119 |
| `hermes-desktop.martinwa.org` | `http://100.118.5.51:5174` | Hermes desktop companion; sets `Host: hermes.kangaroo-eel.ts.net` |
| `hermesagent.martinwa.org` | `http://100.98.205.112:9119` | The **older/original** Hermes agent (ct450 "hermesagent"), kept alive alongside the current ct460 instance |
| `ssh-hermes.martinwa.org` | `ssh://100.118.5.51:22` | SSH to this host over the tunnel |
| `mcp-portal.martinwa.org` | (not in ct207 ingress list; see note below) | Referenced in Hermes config as an MCP server URL (`https://mcp-portal.martinwa.org/mcp`) |
| `omniroute.martinwa.org` | `http://omniroute.kangaroo-eel.ts.net:20128` | Public front for [[systems/omniroute]] |
| `nanobot.martinwa.org` / `nano-ssh.martinwa.org` | `100.122.189.81` (ct333 "clawtest") | See [[comparisons/hermes-vs-nanobot]] |
`mcp-portal.martinwa.org` is not present in the ct207 ingress list captured during this audit — it may be served by a different tunnel/host, or the ingress list may have moved since. **Unknown**, flagged for follow-up rather than guessed.
## Full ct207 ingress list (context, not all Hermes-related)
The tunnel also fronts: `pve.martinwa.org` (Proxmox UI), `docker.martinwa.org` (Portainer), `runtipi.martinwa.org`, `homar.martinwa.org`, `nextcloud.martinwa.org`, `readlater.martinwa.org`, `velvet.martinwa.org`, `overtchat.martinwa.org`, `freellmapi.martinwa.org`, `omnideb.martinwa.org`, `newstarter.martinwa.org`, and SSH endpoints for debianvm/pve/webserver. These belong to the wider homelab, not Hermes specifically — recorded here only so an ingress diff is possible later.
## History
- ct207's `/etc/cloudflared/` directory has ~25 dated `config.yml.bak*` files going back to 2026-06-18, including several during ct460's own setup (`config.yml.before-hermes-ct460-20260717203530`, `...before-hermes-desktop-20260718`, `...before-hermesagent-20260718085557`) — evidence the ingress list has been actively iterated on throughout Hermes's bring-up.
## Relevant runbooks
- [[runbooks/diagnose-docker]]
## Related
- [[systems/cloudflare-tunnel]]
- [[infrastructure/network-map]]
- [[infrastructure/hosts]]
infrastructure/hosts.md
+66
View File
@@ -0,0 +1,66 @@
---
title: Known Hosts and Paths
type: infrastructure
status: partial
created: 2026-07-22
updated: 2026-08-14
verified_on: 2026-07-22
confidence: medium
tags: [infrastructure, hosts, containers, paths]
sources: []
---
# Known Hosts and Paths
## Verified Hosts
| Host | Role | Address | Verified |
|---|---|---|---|
| localhost (this host) | Primary Hermes runtime, Xvfb, file storage | `:102` display | Yes |
| litellm | LiteLLM proxy | `http://litellm:4000/v1` | Yes (from config) |
| omni | OmniRoute proxy | `http://omni:20128/v1` | Yes (from config, 2026-08-13) |
| CT201 | Steel Browser, Runtipi, Homepage dashboard | `100.96.244.39` (Tailscale), `192.168.178.166` (LAN) | Yes (live probe) |
| CT460 | Hermes host, Camoufox, cua-driver | `hermes.kangaroo-eel.ts.net` | Yes |
| CT450 (hermesagent) | Hermes Agent v0.19.0, hermes-webui, hermes-ui (Vite) | `100.98.205.112` (Tailscale), `192.168.178.65` (LAN) | Yes |
## Project Paths
| Path | Type | Notes |
|---|---|---|
| `/home/hermes` | Hermes home | `~/.hermes/` contains config, skills, cache |
| `/home/hermes/workspace` | Workspace | default terminal cwd |
| `/home/hermes/.local/bin/hermes` | Hermes binary | |
| `/home/hermes/.hermes/config.yaml` | Config | version 33 |
| `/home/hermes/.hermes/skills/` | Skills dir | 66 skills installed |
| `/home/hermes/.hermes/cron/` | Cron jobs | 25 active jobs |
| `/home/hermes/.hermes/mnemosyne/` | Mnemosyne DB | backups/, data/, logs/, models/ |
| `/home/hermes/.cua-driver/packages/releases/0.9.0-x86_64-unknown-linux-gnu/cua-driver` | cua-driver | v0.9.0 |
| `~/.camofox/` | Camofox profiles | managed persistence |
| `~/.camoufox/` | Camoufox profiles | multiple profiles present |
| `/home/hermes/.hermes/browser_screenshots/` | Browser captures | |
| `/home/hermes/wiki/` | Wiki | This knowledge base |
| `/home/hermes/obsidian-vault/` | Obsidian vault | personal notes (50 - Research etc.) |
| `/home/hermes/hermes-webui/` | Hermes WebUI | web UI source |
| `/home/hermes/hermes-ui/` | Hermes Desktop browser (Vite dev) | present on CT460 and CT450 port 5174 |
| `/home/hermes/camofox-browser/` | Camofox browser | |
| `/home/hermes/camoufox/` | Camoufox source | |
| `/home/hermes/services/` | Services dir | |
| `/home/hermes/www/` | Web root | |
| `/home/hermes/go/` | Go workspace | |
| `/home/hermes/Downloads/` | Downloads | |
## Compose Files (Docker runtime state unknown)
- `/home/hermes/.hermes/hermes-agent/docker-compose.yml`
- `/home/hermes/hermes-webui/docker-compose.yml`
- `/home/hermes/workspace/readlater/docker-compose.yml`
## Homelab References
- **PVE host:** `pve.kangaroo-eel.ts.net` (100.96.100.82) per session notes — Unverified on this host
- **CT600:** OmniRoute server (retired → CT601 `omni`, 2026-08-13) — Verified via `pct list`
## Unverified
- CT600, CT333, and other remote Proxmox containers/VMs referenced in session notes but not confirmed from this host
- PVE host identity not confirmed from this host without explicit confirmation
## Related
- [[docker-services]]
infrastructure/network-map.md
+65
View File
@@ -0,0 +1,65 @@
---
title: Network Map
type: infrastructure
status: active
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: high
tags: [infrastructure, network]
sources: [raw/configs/hermes-config-sanitized.txt]
---
# Network Map
## Purpose
Where Hermes and its dependencies run, and how traffic reaches them.
## Zones
### LAN
- **Cluster host (pve):** `192.168.178.39` (Proxmox VE, kernel 6.17.4-1-pve)
- **This container (hermes, ct460):** `192.168.178.129` (DHCP, eth0)
### Tailscale (`kangaroo-eel.ts.net`)
- **pve:** `100.96.100.82`
- **hermes (ct460):** `100.118.5.51`
- **hermesagent (ct450, the original/legacy Hermes agent dashboard):** `100.98.205.112`
- **omniroute (ct600):** resolves via `omniroute.kangaroo-eel.ts.net` → `100.88.81.19`
- **nanobot (ct333, "clawtest"):** `100.122.189.81`
- **webserver (ct207, runs the Cloudflare Tunnel):** `100.82.40.23`
- **debianvm (VM 101):** `100.98.95.65`
- **docker host (ct200):** `100.96.150.69`
- **openweb (ct245):** `100.69.230.13`
- **nextcloud (ct270):** `100.90.102.19`
### Public (Cloudflare Tunnel)
- Origin daemon runs on **ct207 (webserver)**, not on this host. See [[systems/cloudflare-tunnel]] and [[infrastructure/domains-and-tunnels]] for the full ingress list.
- This host is reached publicly via two routes defined in that tunnel: `hermes.martinwa.org` → `100.118.5.51:19119` (nginx-fronted webui) and `hermes-desktop.martinwa.org` → `100.118.5.51:5174` (desktop companion).
## Local ports on this host (ct460)
| Port | Bind | Process | Purpose |
|---|---|---|---|
| 22 | `*` | sshd | SSH |
| 80 / [::]:80 | `*` | nginx | reverse proxy, default vhost |
| 19119 | `*` | nginx → 127.0.0.1:9119 | public Hermes webui path (tunneled) |
| 9119 | `0.0.0.0` | hermes (webui) | Hermes Web UI backend |
| 8644 / 8642 | `*` | hermes | additional Hermes agent ports |
| 5174 | `*` | node | Hermes desktop companion (tunneled as hermes-desktop.martinwa.org) |
| 9377 | `*` | node | Stratos — AI Command Centre |
| 8787 | `127.0.0.1`* | python | Hermes gateway health endpoint (see [[runbooks/update-hermes-safely]]) |
| 9099 / 8790 | `*` | python3 | auxiliary Hermes processes (unverified purpose) |
| 5901 / [::]:5901 | `*` | x11vnc | VNC on Xvfb `:99`, see [[systems/headless-server]] |
| 6080 / 6081 | `127.0.0.1` | websockify | noVNC web bridges for two VNC displays |
| 25 | `127.0.0.1` / `[::1]` | postfix | local mail transport |
\* `curl` target used in [[runbooks/update-hermes-safely]] health check; binding not independently re-verified in this pass.
## Relevant runbooks
- [[runbooks/diagnose-docker]]
- [[runbooks/recover-docker-service]]
## Related
- [[infrastructure/hosts]]
- [[infrastructure/domains-and-tunnels]]
- [[systems/cloudflare-tunnel]]
infrastructure/proxmox.md
+72
View File
@@ -0,0 +1,72 @@
---
title: Proxmox VE
type: infrastructure
status: active
created: 2026-07-26
updated: 2026-08-13
confidence: high
tags: [proxmox, virtualization, infrastructure, homelab]
---
# Proxmox VE
## Purpose
Hypervisor hosting all VMs and LXC containers for the homelab.
## Details
- **Host:** `pve.kangaroo-eel.ts.net` (Tailscale: `100.96.100.82`)
- **Node name:** `pve`
- **Version:** Proxmox VE 8.x
- **Primary user:** `Anthony@pam` (full admin)
- **Additional users:** `root@pam`, `glance@pve`, `prom-exporter@pve`, `homepage@pve`
## VMs (QEMU)
| VMID | Name | Status | Purpose |
|---|---|---|---|
| 101 | debianvm | running | Debian VM — Portainer, filebrowser, code-server, Sunshine |
| 100 | homeassistant | running | Home Assistant |
| 282 | ubuntu-server-xfce | running | Ubuntu desktop — Sunshine, Kubuntu |
| 403 | open-claw | running | OpenClaw agent |
| 401 | hermes-old | stopped | Legacy Hermes VM (deprecated) |
## LXC Containers
| VMID | Name | Status | Purpose |
|---|---|---|---|
| 200 | docker | running | Main Docker host — 42+ containers |
| 201 | runtipi | running | Runtipi — Homepage, ntfy, etc. |
| 205 | ollama | running | Ollama LLM inference + Guanaco proxy (v0.8.14, updated 2026-08-14) |
| 207 | webserver | running | Web server — Vercel AI, manifest router |
| 215 | n8n | running | N8n automation |
| 221 | gitea | running | Gitea git server |
| 241 | ntfy | running | Ntfy push notifications |
|| 245 | openweb | running | Open WebUI (Jul 30 updated, memory 4096 MB) |
| 255 | mattermost | running | Mattermost chat |
| 260 | freshrss | running | FreshRSS feed reader |
| 270 | nextcloud | running | NextCloud |
| 299 | sftpgo | running | SFTPGo file server — security review 2026-08-09: connects as root, unpinned fingerprint, `//` root path |
| 310 | monitoring | stopped | Monitoring stack (deprecated) |
| 333 | clawtest | running | ClawTest — Nanobot, Zeroclaw |
| 450 | hermesagent | running | Hermes Agent LXC |
| 460 | hermes | running | Hermes CT460 |
| 465 | qwenpaw | running | QwenPaw LLM |
| 500 | litellm | running | LiteLLM proxy |
| 555 | elementsynapse | stopped | Element Synapse (deprecated) |
| 600 | omniroute | stopped | OmniRoute model router — retired 2026-08-13, migrated to CT601 |
| 601 | omni | running | OmniRoute model router — successor to CT600, since 2026-08-13 |
| 103 | cliproxyapi | running | Cliproxy API |
| 104 | rclone | running | Rclone sync |
| 106 | glance | stopped | Glance dashboard |
| 209 | cloudreve | stopped | Cloudreve (deprecated) |
## API Tokens
- `homepage@pve!homepage` — PVEAuditor role, privsep=0 (used by Homepage dashboard)
## Key Paths
- `/etc/pve/` — PVE config directory
- `/var/lib/vz/` — Local storage
- `/etc/pve/priv/token/` — API token storage
## Related
- [[systems/homepage-dashboard]] — Dashboard shows PVE stats
- [[infrastructure/hosts]] — Full host inventory
- [[infrastructure/network-map]] — Network topology
infrastructure/tailscale.md
+72
View File
@@ -0,0 +1,72 @@
---
title: Tailscale
type: infrastructure
status: active
created: 2026-07-26
updated: 2026-07-27
verified_on: 2026-07-27
confidence: high
tags: [tailscale, vpn, networking, infrastructure]
---
# Tailscale
## Purpose
WireGuard-based mesh VPN connecting all homelab hosts and providing HTTPS access via Tailscale Serve.
## Domain
- **Tailnet:** `kangaroo-eel.ts.net`
- **Primary node:** CT460 (`hermes.kangaroo-eel.ts.net`)
- **Runtipi node:** CT201 (`runtipi.kangaroo-eel.ts.net`)
## CT460 Serve Routes
| Path | Target | Notes |
|---|---|---|
| `/` | `http://127.0.0.1:9119` | Hermes WebUI |
| `/jobs` | `http://127.0.0.1:9099` | Jobs Dashboard |
| `/desktop` | `http://127.0.0.1:6081` | CUA noVNC |
| `/vnc-camofox` | `http://127.0.0.1:6080` | Camofox VNC |
## CT460 Funnel Routes
| Port | Target | Notes |
|---|---|---|
| `:8443/webhook` | `http://127.0.0.1:8085/webhook` | Public webhook Funnel |
## CT201 Serve Routes
| Path | Target | Notes |
|---|---|---|
| `:8443` | `http://localhost:8082` | Homepage dashboard |
| `/steel` | `http://127.0.0.1:5173` | Steel Browser UI |
| `/steel-api` | `http://127.0.0.1:3000` | Steel Browser API (path prefix not stripped — use direct IP for API calls) |
## Atomic Restore Script
`/home/hermes/.hermes/scripts/tailscale-serve-apply.sh` — Rebuilds the complete CT460 route table, including tailnet Serve on `:443` and public Funnel on `:8443`.
`tailscale serve reset` clears Funnel state as well as Serve state. The atomic script therefore restores `/webhook` after rebuilding the 443 routes. Do not use the older Serve-only restore path for complete recovery.
## Key Commands
```bash
# Check routes
tailscale serve status
# Rebuild routes (CT460)
/home/hermes/.hermes/scripts/tailscale-serve-apply.sh --dry-run
/home/hermes/.hermes/scripts/tailscale-serve-apply.sh
# Add route
tailscale serve --set-path /jobs http://127.0.0.1:9099
# Remove route
tailscale serve --set-path /jobs off
```
## Notes
- Port 443 occupied by Traefik on CT201 — Tailscale uses port 8443 there
- CT460 has no conflict — Tailscale uses 443 directly
- Routes must be re-added in order (restore script handles this)
- After every rebuild, verify that `tailscale serve status` contains both the `:443` Serve routes and the `:8443/webhook` Funnel route.
## Related
- [[infrastructure/domains-and-tunnels]] — Full DNS and tunnel inventory
- [[systems/homepage-dashboard]] — Homepage on CT201 via Tailscale
- [[runbooks/job-radar]] — Dashboard incident and route verification