memory: wgtunnel moved to its own repo (vh/wgtunnel) — endpoint infra verified + pre-seeded
Flip the queued-project pointer: wgtunnel is now a standalone repo, pre-seeded after a live verification pass (ana-wg UDP/31337 endpoint, traefik TLS edge on ana-docker, direct-A public edge). Ground truth captured in the new repo; /vor-plan is the next step. Do wgtunnel work in ~/development/wgtunnel, not here.
This commit is contained in:
@@ -109,9 +109,9 @@ no longer deployed sidecars here. See Recent decisions.)
|
||||
|
||||
## Current state / in-flight
|
||||
|
||||
_As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). NEXT PROJECT queued: **wgtunnel**._
|
||||
_As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). **wgtunnel** moved OUT to its own repo (pre-seeded, verification done)._
|
||||
|
||||
- **⟳ NEXT PROJECT — `wgtunnel`** (queued 2026-08-12, greenfield, not started): a WireGuard tunnel that works while on a plane's wifi. Core challenge = airplane/captive-portal wifi blocks UDP + only allows TCP/443 after portal auth, so plain WG won't traverse → needs **WG-over-TCP/443 obfuscation** (wstunnel / udp-over-tcp / udp2raw / TLS-wrap) + captive-portal handling. Fresh session starts here (likely a `/vor` or `/vor-plan` pass; ask scope + persist location first). Full seed in `/tmp/infra-ops-handoff.md`.
|
||||
- **⟳ wgtunnel — OWN REPO STOOD UP (`vh/wgtunnel`, private, pushed 2026-08-12); design not started.** A WireGuard tunnel that comes up on a plane's captive-portal wifi (blocks UDP, only TCP/443 after portal → needs WG-over-TCP/443 obfuscation + captive-portal handling). Endpoint infra **verified live** this session: WG server = `ana-wg` **UDP/31337** (subnet 10.30.10.0/24, MTU 1420, public UDP DNAT already works); public TLS edge = **traefik on ana-docker** (terminates TLS :443, ACME `anaprod`, docker+file providers, CrowdSec bouncer); edge IP `38.120.12.44` (direct A). Working architecture = **wstunnel WSS/443 behind traefik → ana-wg:31337** (starting hypothesis). Ground truth in `~/development/wgtunnel/docs/verified-infrastructure.md`. **NEXT: `/vor-plan` (multi-unit) or `/vor` — operator's call, interactive.** Do wgtunnel work in that repo, not here.
|
||||
|
||||
- **SECRETS-BROKER — LIVE.** Per-box credential store over Vaultwarden; the `secret` CLI (`put/get/list/rm/backfill`) on PATH at `~/.local/bin/secret`, 25 nh3-dev secrets backfilled + verified. Standing directive now global: **vault is the credential source of truth — store in it AND `secret get` creds FROM it.** Detail → Recent decisions `[2026-08-10→12]`.
|
||||
|
||||
@@ -138,6 +138,8 @@ _As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail i
|
||||
|
||||
## Recent decisions
|
||||
|
||||
- `[2026-08-12]` **wgtunnel stood up as its own repo (`vh/wgtunnel`, private) after a live endpoint-verification pass.** Operator directed own-repo (mirrors stonehenge-park/tts-stack). Verified off the fleet before seeding: `ana-wg` WG server = **UDP/31337** (not 51820), subnet 10.30.10.0/24, MTU 1420, active roaming peer proves the public UDP DNAT works; traefik on ana-docker **terminates TLS :443** (ACME `anaprod` http-challenge, docker+file providers, CrowdSec bouncer) → confirms the clean design (wstunnel container on `traefik-net`, Host-routed, WS→UDP to `ana-wg:31337`); edge `38.120.12.44` direct-A, `tunnel.phasefinal.com` free (⚠ must be **direct**, NOT Cloudflare-proxied like vaultwarden). Repo pre-seeded (README/CLAUDE/persistent-memory/ROADMAP + `docs/verified-infrastructure.md` = ground truth) + pushed; commit `9584d38`, Vuong-attributed. vh gitea token pulled from the vault (`secret get`), not persisted to `.git/config`. **NEXT = `/vor-plan` or `/vor` (operator's call, interactive).** Deps to line up in the plan: DNS A-record, FortiGate :443 host-routing, a new ana-wg peer for the laptop, client tooling.
|
||||
|
||||
- `[2026-08-10→12]` **secrets-broker: per-box Vaultwarden credential store SHIPPED + consumer-confirmed.** `secret` CLI (`put/get/list/rm/backfill`, bw-backed) on `~/.local/bin`; 25 nh3-dev secrets backfilled + round-trip-verified; `rm` + new-namespace warning added post-launch; standing "vault is the credential source of truth" directive now global. → `persistent-memory.d/2026-08-12-secrets-broker.md`
|
||||
|
||||
- `[2026-08-11]` **stonehenge-park: new fleet `/park` service repo stood up + designed (`/vor-plan` + `/vor-ui`).** Self-contained SQLite+FastAPI idea-parking service that actively resurfaces (statusline + althing) so nothing dies in a cold repo; `vh/stonehenge-park` pushed + pre-seeded for a fresh agent; build starts at the U1 tracer contract. → `persistent-memory.d/2026-08-11-stonehenge-park.md`
|
||||
|
||||
Reference in New Issue
Block a user