Spendlik/Claude_Homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Log collections.spendlik.sk DNS record ID (340219244), update CT 114 status to live-over-HTTPS, add nginx CT-placement/filename gotchas

Browse Source
This commit is contained in:
Spendlik 2026-08-11 09:43:21 +00:00
parent d1f739f66b
commit baee2d55fe
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
00_index.md
View File

@ -36,7 +36,7 @@
| 110 | windows11 (VM) | 192.168.1.227 | — | RTX 4060 passthrough, Rhino 7 + Sunshine/Moonlight | | 110 | windows11 (VM) | 192.168.1.227 | — | RTX 4060 passthrough, Rhino 7 + Sunshine/Moonlight |
| 111 | paperless | 192.168.1.111 | paperless.spendlik.sk | Document management (6-lang OCR, media+data on NAS) | | 111 | paperless | 192.168.1.111 | paperless.spendlik.sk | Document management (6-lang OCR, media+data on NAS) |
| 112 | mcp-server | 192.168.1.100 | mcp.spendlik.sk | MCP bridge — Proxmox + Gitea tools for Claude | | 112 | mcp-server | 192.168.1.100 | mcp.spendlik.sk | MCP bridge — Proxmox + Gitea tools for Claude |
| 114 | koillection | 192.168.1.114 | collections.spendlik.sk | Collection manager — CT created 2026-08-11, **app deployment in progress** (Docker/Koillection/nginx/SSL/DNS still pending, see `114_koillection_deployment.md`) | | 114 | koillection | 192.168.1.114 | collections.spendlik.sk | Collection manager — live over HTTPS as of 2026-08-11 (Docker/nginx/SSL/DNS done); **Authelia decision + first admin login still pending**, see `114_koillection_deployment.md` |
| 115 | vaultwarden | 192.168.1.115 | vault.spendlik.sk | Password manager (Vaultwarden, Docker, Bitwarden-compatible) | | 115 | vaultwarden | 192.168.1.115 | vault.spendlik.sk | Password manager (Vaultwarden, Docker, Bitwarden-compatible) |
> ⚠️ CT 117 (Radicale) has a deployment guide written but is **NOT yet deployed** — do not treat as live infrastructure. It will be added to this table once physically provisioned. > ⚠️ CT 117 (Radicale) has a deployment guide written but is **NOT yet deployed** — do not treat as live infrastructure. It will be added to this table once physically provisioned.
@ -64,8 +64,8 @@ Script location: `/usr/local/bin/ddns-update.sh` in CT 108. Full credentials map
| mcp.spendlik.sk | 327475181 | | mcp.spendlik.sk | 327475181 |
| paperless.spendlik.sk | 328109687 | | paperless.spendlik.sk | 328109687 |
| vault.spendlik.sk | 330343277 | | vault.spendlik.sk | 330343277 |
| collections.spendlik.sk | 340219244 |
| pdf.spendlik.sk | *(add after DNS record created in WebSupport)* | | pdf.spendlik.sk | *(add after DNS record created in WebSupport)* |
| collections.spendlik.sk | *(add after CNAME record created in WebSupport — Koillection app deployment in progress)* |
| cal.spendlik.sk | *(add after DNS record created in WebSupport — Radicale not yet deployed)* | | cal.spendlik.sk | *(add after DNS record created in WebSupport — Radicale not yet deployed)* |
> ⚠️ When adding a new subdomain: (1) create **CNAME** record → `spendlik.sk` in WebSupport admin (never a per-subdomain A record), (2) add nginx vhost in CT 101, (3) run certbot, (4) inspect nginx config after certbot. No DDNS script edit needed — see above. > ⚠️ When adding a new subdomain: (1) create **CNAME** record → `spendlik.sk` in WebSupport admin (never a per-subdomain A record), (2) add nginx vhost in CT 101, (3) run certbot, (4) inspect nginx config after certbot. No DDNS script edit needed — see above.
@ -93,7 +93,7 @@ Script location: `/usr/local/bin/ddns-update.sh` in CT 108. Full credentials map
| `secrets-index.md` | Map of service credentials and WHERE they are stored (no actual secrets) | | `secrets-index.md` | Map of service credentials and WHERE they are stored (no actual secrets) |
| `PROJECT_INSTRUCTIONS.md` | Canonical behavioural/methodology reference — decision defaults, checklists, gotchas, **Pre-Flight Verification protocol (added 2026-08-11)** | | `PROJECT_INSTRUCTIONS.md` | Canonical behavioural/methodology reference — decision defaults, checklists, gotchas, **Pre-Flight Verification protocol (added 2026-08-11)** |
| `113_stirling_pdf_deployment.md` | CT 113 — Stirling PDF Docker deploy, nginx, SSL, n8n API integration | | `113_stirling_pdf_deployment.md` | CT 113 — Stirling PDF Docker deploy, nginx, SSL, n8n API integration |
| `114_koillection_deployment.md` | CT 114 — Koillection Docker deploy, NAS uploads mount, collection setup — **IN PROGRESS: CT created 2026-08-11, app install pending** | | `114_koillection_deployment.md` | CT 114 — Koillection Docker deploy, NAS uploads mount, collection setup — **IN PROGRESS: live over HTTPS, Authelia + first login pending** |
| `115_vaultwarden_deployment.md` | CT 115 — Vaultwarden Docker deploy, nginx, SSL | | `115_vaultwarden_deployment.md` | CT 115 — Vaultwarden Docker deploy, nginx, SSL |
| `117_radicale_deployment.md` | CT 117 — Radicale CalDAV/CardDAV deploy, nginx, SSL, Thunderbird/DAVx⁵ clients — **guide only, not yet deployed** | | `117_radicale_deployment.md` | CT 117 — Radicale CalDAV/CardDAV deploy, nginx, SSL, Thunderbird/DAVx⁵ clients — **guide only, not yet deployed** |
@ -102,6 +102,7 @@ Script location: `/usr/local/bin/ddns-update.sh` in CT 108. Full credentials map
> 💡 Files `01_` through `11_` referenced previously do not exist — they were placeholders never written. > 💡 Files `01_` through `11_` referenced previously do not exist — they were placeholders never written.
> 💡 For "is CT X running/deployed right now" questions, don't read docs — call `proxmox_list_containers` directly (single cheap live call, always accurate). > 💡 For "is CT X running/deployed right now" questions, don't read docs — call `proxmox_list_containers` directly (single cheap live call, always accurate).
> 💡 Before running Phase 1 of any not-yet-executed deploy guide, verify volatile values (LXC template version, DNS record type) against `homelab-overview.md` and `obsidian-vault/05 Resources/Proxmox LXC Templates.md` — guides can go stale. See `PROJECT_INSTRUCTIONS.md` → Pre-Flight Verification. > 💡 Before running Phase 1 of any not-yet-executed deploy guide, verify volatile values (LXC template version, DNS record type) against `homelab-overview.md` and `obsidian-vault/05 Resources/Proxmox LXC Templates.md` — guides can go stale. See `PROJECT_INSTRUCTIONS.md` → Pre-Flight Verification.
> 💡 Also verify nginx vhost naming convention (full domain, not short service name) and which CT nginx work belongs on (CT 101, never the app container) before giving nginx-related steps — see `114_koillection_deployment.md` Phase 6 gotchas for a concrete example of both mistakes happening in the same deployment.
--- ---
@ -119,6 +120,8 @@ Script location: `/usr/local/bin/ddns-update.sh` in CT 108. Full credentials map
| **Gitea writes** | Always read file content before writing — writes replace entire file | | **Gitea writes** | Always read file content before writing — writes replace entire file |
| **Proxmox kernel** | PINNED to `6.14.11-5-pve` (`proxmox-boot-tool kernel pin`). **2026-08-11 incident**: an accidental `apt upgrade -y` run directly on the Proxmox host (meant for a container) pulled in `proxmox-kernel-6.14.11-9-pve` and the entire `proxmox-kernel-7.0.x` branch. No impact occurred — the boot pin held, running kernel never changed, NVIDIA DKMS module remained built against the pinned `6.14.11-5-pve` only. Resolved by re-affirming the pin and running `apt-mark hold proxmox-kernel-6.14 proxmox-kernel-7.0 proxmox-kernel-6.14.11-9-pve proxmox-kernel-7.0.14-11-pve-signed proxmox-kernel-7.0.6-2-pve`, which now blocks apt from proposing these kernel packages at all. **Verify hold status with `apt-mark showhold` before assuming any future `apt upgrade` on the host is kernel-safe.** | | **Proxmox kernel** | PINNED to `6.14.11-5-pve` (`proxmox-boot-tool kernel pin`). **2026-08-11 incident**: an accidental `apt upgrade -y` run directly on the Proxmox host (meant for a container) pulled in `proxmox-kernel-6.14.11-9-pve` and the entire `proxmox-kernel-7.0.x` branch. No impact occurred — the boot pin held, running kernel never changed, NVIDIA DKMS module remained built against the pinned `6.14.11-5-pve` only. Resolved by re-affirming the pin and running `apt-mark hold proxmox-kernel-6.14 proxmox-kernel-7.0 proxmox-kernel-6.14.11-9-pve proxmox-kernel-7.0.14-11-pve-signed proxmox-kernel-7.0.6-2-pve`, which now blocks apt from proposing these kernel packages at all. **Verify hold status with `apt-mark showhold` before assuming any future `apt upgrade` on the host is kernel-safe.** |
| **LXC template versions** | Verify exact template filename in `obsidian-vault/05 Resources/Proxmox LXC Templates.md` (or live `pveam list local`) before every `pct create` — versions bump periodically and guides can reference stale strings. Once a container is created, template version is irrelevant — `apt upgrade` keeps it current, no need to recreate existing containers on a newer template. | | **LXC template versions** | Verify exact template filename in `obsidian-vault/05 Resources/Proxmox LXC Templates.md` (or live `pveam list local`) before every `pct create` — versions bump periodically and guides can reference stale strings. Once a container is created, template version is irrelevant — `apt upgrade` keeps it current, no need to recreate existing containers on a newer template. |
| **nginx vhosts belong on CT 101 only** | Never install or configure nginx on an app's own container — all reverse-proxy work happens on CT 101. Check the shell prompt if unsure which container you're in. |
| **nginx vhost filenames** | Named by full domain (e.g. `collections.spendlik.sk`), not by short service name — verify with `ls /etc/nginx/sites-available/` on CT 101 before writing a new one. |
| **OpenRGB** | Uninstalled — SMBus interaction with ADATA XPG GAMMIX D35 poses hardware risk. Do not reinstall. | | **OpenRGB** | Uninstalled — SMBus interaction with ADATA XPG GAMMIX D35 poses hardware risk. Do not reinstall. |
| **Hairpin NAT** | Slovak Telekom router blocks hairpin — test external domains from mobile data, not LAN | | **Hairpin NAT** | Slovak Telekom router blocks hairpin — test external domains from mobile data, not LAN |
| **WebSupport API auth** | HMAC-SHA1 signed requests; `X-Date` header in `YYYYMMDDTHHmmSSZ` format; service ID is numeric `15056760` | | **WebSupport API auth** | HMAC-SHA1 signed requests; `X-Date` header in `YYYYMMDDTHHmmSSZ` format; service ID is numeric `15056760` |
@ -139,7 +142,7 @@ Script location: `/usr/local/bin/ddns-update.sh` in CT 108. Full credentials map
| Project | Next Action | Reference | | Project | Next Action | Reference |
|---|---|---| |---|---|---|
| Koillection | CT 114 created 2026-08-11 — continue with Phase 2 (Docker install) onward | CT 114 | | Koillection | Live over HTTPS (`https://collections.spendlik.sk`) — decide Authelia vs. bypass (Phase 9), then first admin login + collection setup (Phase 10–11) | CT 114 |
| kocka-novinky.sk automation | Build n8n POC: Brickset → Claude API → WordPress lego-set + post | CT 100 | | kocka-novinky.sk automation | Build n8n POC: Brickset → Claude API → WordPress lego-set + post | CT 100 |
| Paperless-ngx | ~730 docs processing; next: Gemini post-processing setup | CT 111 | | Paperless-ngx | ~730 docs processing; next: Gemini post-processing setup | CT 111 |
| Gemini post-processing | Get Gemini API key → install Python package in CT 111 | CT 111 | | Gemini post-processing | Get Gemini API key → install Python package in CT 111 | CT 111 |