2 Commits

Author	SHA1	Message	Date
vh	39da1d4a97	feat(homepage): recategorise on "do I open this?", collapse the API groups ... The board mixed tools with endpoints. A vLLM seat whose href is a /docs page sat in the same band as ComfyUI; the MQTT broker and the RustDesk relay, which have no page at all, sat in Apps; and `Service Networking` was thirteen members spanning three AdGuards, five Dockges, two Traefiks and four headless agents. Every group is now one of two kinds and they never mix. TOOLS are expanded and sit at the top of their tab. ENDPOINTS — an API, a broker, a background agent, an href that is /docs or /ping or nothing — carry `initiallyCollapsed: true` and sit at the bottom. Collapsed is not hidden: the eyebrow and its rule still render, so the tab still says the thing exists and one click expands it. A second rule fell out of the same pass and now shapes the group boundaries: a group's members should all carry a widget or none should. A stat strip makes a card ~50px taller, so one widget card in a row of plain ones opens a void under the plain ones. That is why AdGuard and Traefik get their own groups rather than sharing one with Dockge, and it is most of why the old Service Networking band looked broken. AdGuard (ANA) was the last short card in its row and now carries the same query/blocked/latency strip as its two siblings — one infra-ops AdGuard login authenticates against all three instances, verified against each; it lives in that stack's .env on the host and is vaulted. The sixteen GPU-backed model seats were deliberately NOT relabelled. `homepage.group` is read at container creation, so clearer names for `AI - Inference` and friends would have cost a recreate on six vLLM seats, four eval seats and four TTS engines — multi-minute model reloads on endpoints peers reach through the gateway. Order plus `initiallyCollapsed` buys the same separation for nothing, so those names stay as they are on purpose. 28 containers that ARE cheap to bounce were relabelled, across five hosts, via rerunnable elway playbooks. Their label steps are gated on the old value still being present, so a second run reports skipped rather than churning. Two verify steps were wrong on first contact and are fixed with the reason recorded: the traefik check raced its own recreate, and asserting a model seat is "running" cannot answer "did I bounce it" when a seat may be legitimately stopped — container age can, and now does. The canonical stacks/ tree was synced to the deployed labels afterwards, so intent and reality agree again on all fourteen tracked stacks. Also documents the real nature of the post-recreate blank dashboard, which cost ~25 minutes here and an hour on 2026-08-19. `initialSettings":{}` in the served HTML is the catch branch of the page's data loader, not a warm-up and not a cache — and the error can vanish entirely, because the logger is assigned inside the same try and the catch only logs if the logger exists. Ruled out by measurement this time: all four API routes return 200 with correct content while the page serves {}, and the previous known-good settings.yaml reproduces it identically. The README now carries the one-command test and the next lead. Before/after, all four tabs: http://10.100.10.50:8090/b/homepage-relayout/	2026-08-24 08:54:06 -07:00
vh	b8003c73ae	feat(dns): fleet .internal naming — git-sourced, agent-managed, three resolvers ... Names for fleet hosts so addresses stop needing to be memorised. Built because IPv6 makes that hopeless — and, more to the point, because v6 addresses are derived rather than assigned, so they cannot reliably be written down once and trusted either. dns/internal.yaml source of truth: 38 hosts + 4 service aliases scripts/dns-sync.py reconciles AdGuard resolvers against it stacks/adguard-ana/ the colo's resolver, which did not exist Naming is <host>.<site>.internal with sites ana/esh/nh3 (operator's call). .internal is ICANN-reserved for this; .local is reserved for mDNS, which is why searxng.pfi.local was a collision that merely happened to work. Same posture as deploy-stack.sh: file is intent, resolvers are derived state, you see a diff before anything changes. Every name is published to every resolver, so the site label says where a host IS, not who knows about it. Two properties that matter: - Authority is scoped to the ZONE, not the resolver. ESH carries hand-made esteban.net rewrites predating this; they are read, ignored and preserved. Resolver-wide authority would have silently deleted them. - Within .internal it IS authoritative, so UI-added names get removed. That is the point — one place to look. Colo gap closed: ana-docker had no resolver at all (hosts went straight to 1.1.1.1). Its AdGuard runs API on 8053 because 8080/3000 were taken, so the port is carried per-site in the yaml rather than assumed by the script. It ships with no blocklists — a false positive on a server network breaks service-to-service calls for no upside. Auth is a dedicated infra-ops AdGuard user, not the operator's account, password vaulted at nh3-dev/adguard-infra-ops-password. Pre-change configs backed up on each resolver. Both resolvers stayed answering across the restart. searxng.pfi.local -> searxng.ana.internal, with the old Host() kept alongside so nothing breaks mid-migration. matrix.pfi.local deliberately NOT migrated: a Matrix server_name is baked into every user id, room id and signing key, so renaming it rebuilds the homeserver's identity rather than changing a DNS name. The v6 column is empty and correct — no fleet host has a global v6 address yet. The file documents why addresses must be pinned statically before they go in, since a record that silently stops matching is worse than no record.	2026-08-19 01:10:55 -07:00