vh d775a01856 feat(bootstrap-infra-ops): create new accounts at the fleet-pinned uid/gid 850 ...

docs/pfi/fleet-conventions.md § 3 pins infra-ops to 850, but the bootstrap
playbook let the OS allocate, so every host drifted (1001-2001). New
accounts now get 850 when uid and gid 850 are both free, and fall back to
OS allocation (with a note) when either is taken. The home is set to 0700
per § 1.2. Existing accounts are untouched (the step is gated on id).

Scope note: vm-esh-nas is added to the operator-granted ESH exceptions
(Prime, 2026-09-27).

2026-09-27 01:53:22 -07:00

..

files

feat(ana-ml2): persist mesh return routes via ana-scale as an ifupdown if-up.d hook (playbooks/ana-ml2-mesh-routes.yaml, elway-applied, verified)

2026-09-08 23:49:38 -07:00

althing-alert-bridge.yaml

feat(alerts): generalize the althing bridge, wire Kuma to it, retire chamber

2026-09-21 23:11:54 -07:00

ana-docker-backup-repair.yaml

fix(playbooks): don't let the preserve step depend on its own guard

2026-09-19 05:34:17 -07:00

ana-docker-cache-budget.yaml

Repair ana-docker database backups and bound CI build caches

2026-09-10 09:10:01 -07:00

arbo-disable-engine-token.yaml

feat(arbo): disable ENGINE_TOKEN bearer auth on prod (WireGuard = boundary)

2026-06-13 14:05:07 -07:00

arbo-runner-uv-symlink.yaml

playbook: put uv/uvx on the irv-ml1-arbo runner PATH

2026-06-16 14:24:24 -07:00

audit-host-conventions.yaml

feat(fleet): pin identity/group/path conventions + read-only audit playbook

2026-09-14 13:30:30 -07:00

beszel-filesystems.yaml

Wire Beszel fleet filesystems, GPU telemetry, dashboard and alerts

2026-09-10 08:35:28 -07:00

beszel-guest-install.yaml

feat(beszel): commit the fleet agent rollout — configs, playbooks and runbooks

2026-09-11 22:09:18 -07:00

beszel-guest-stage.yaml

feat(beszel): commit the fleet agent rollout — configs, playbooks and runbooks

2026-09-11 22:09:18 -07:00

beszel-native.yaml

feat(beszel): commit the fleet agent rollout — configs, playbooks and runbooks

2026-09-11 22:09:18 -07:00

beszel-synology.yaml

feat(beszel): commit the fleet agent rollout — configs, playbooks and runbooks

2026-09-11 22:09:18 -07:00

blend-kokoro-voice.yaml

kokoro: persist custom voices across container recreate

2026-05-10 17:48:24 -07:00

bootstrap-infra-ops-user.yaml

feat(bootstrap-infra-ops): create new accounts at the fleet-pinned uid/gid 850

2026-09-27 01:53:22 -07:00

corviduo-dev-docker-default-ulimits.yaml

feat(corviduo-dev): stage a host-wide docker nofile floor (65536) for WT #401

2026-08-17 15:58:00 -07:00

decouple-pfi-postgres-from-ana-nas.yaml

paperwork: refresh STATUS.md + CLAUDE.md; finalize 4b

2026-04-24 16:31:41 -07:00

deploy-ace-step.yaml

ace-step: patch upstream infer-api + missing runtime deps + cache mount

2026-04-28 09:42:07 -07:00

deploy-asset-engine.yaml

asset-engine + irv-ml1: scaffold orchestrator wiring

2026-05-12 13:24:07 -07:00

deploy-chatterbox.yaml

chatterbox: switch health probe from /health (doesn't exist) to /api/model-info

2026-04-27 16:04:39 -07:00

deploy-fish-s2.yaml

fix(fish-s2): reference_id was a silent no-op — populate per-voice dirs + guard the regression

2026-06-01 16:42:30 -07:00

deploy-gitea-runner.yaml

gitea-runner: stack + playbook for self-hosted Actions

2026-04-29 18:12:36 -07:00

deploy-index-tts.yaml

playbooks: quiet down pip noise in TTS build logs

2026-04-25 16:25:42 -07:00

deploy-kokoro.yaml

kokoro: persist custom voices across container recreate

2026-05-10 17:48:24 -07:00

deploy-kyutai-tts.yaml

voxtral + kyutai-tts: fix wrong image tag / wrong endpoint paths; fish-s2: env-selectable model variant

2026-04-27 23:54:59 -07:00

deploy-lora-training-worker.yaml

feat(lora-worker): Phase 2 publish-step — copy succeeded LoRA into ComfyUI loras + published_lora_name

2026-07-07 00:22:20 -07:00

deploy-memos.yaml

memos: deploy to ana-docker

2026-04-29 13:27:12 -07:00

deploy-miniflux.yaml

stacks/miniflux: flatten to single network; fix verify

2026-04-26 11:55:04 -07:00

deploy-omnivoice.yaml

feat(omnivoice): streaming /tts + language-safe sanitizer

2026-06-19 22:47:15 -07:00

deploy-qwen3-tts.yaml

qwen3-tts: add stack + deploy playbook for irv-ml1

2026-04-24 16:58:19 -07:00

deploy-skaldsong.yaml

skaldsong playbook: verify container is Up, not 'healthy' (was racing start_period)

2026-05-18 23:47:51 -07:00

deploy-stable-audio-open.yaml

ace-step + stable-audio-open: deploy music + SFX generation to irv-ml1

2026-04-28 09:11:23 -07:00

deploy-task-board.yaml

playbooks/deploy-task-board: accept SHA refs, not just branches

2026-04-29 18:41:36 -07:00

deploy-vibevoice.yaml

playbooks/deploy-vibevoice: fix the /v1/audio/voices verify (was greping for nonexistent literals)

2026-04-27 15:37:17 -07:00

deploy-vor.yaml

vor: stack + playbook + workflow template for ana-docker deploy

2026-04-29 21:31:59 -07:00

deploy-voxtral.yaml

stacks/{fish-s2,voxtral,kyutai-tts}: three new TTS deploys for irv-ml1 quality A/B

2026-04-27 22:40:10 -07:00

elway-smoke.yaml

elway: add tier 1 + tier 2 idempotency

2026-04-24 10:39:48 -07:00

esh-cutover-1-quiesce-docker-vm.yaml

feat(esh-pve-nas): cut PVE root over to ZFS on the mirrored NVMe

2026-08-18 06:39:34 -07:00

esh-cutover-2-quiesce-esh-pve.yaml

feat(esh-pve-nas): cut PVE root over to ZFS on the mirrored NVMe

2026-08-18 06:39:34 -07:00

esh-cutover-3-esh-pve-nas.yaml

feat(esh-pve-nas): cut PVE root over to ZFS on the mirrored NVMe

2026-08-18 06:39:34 -07:00

esh-cutover-5-restore-docker-vm.yaml

feat(esh-pve-nas): cut PVE root over to ZFS on the mirrored NVMe

2026-08-18 06:39:34 -07:00

esh-docker-vm-restic-drop-kuma-block.yaml

fix(elway): sudo uploads land root:root, validated and staged; add fleet ownership audit

2026-09-23 09:59:15 -07:00

esh-docker-vm-restic-drop-paperless-block.yaml

fix(elway): sudo uploads land root:root, validated and staged; add fleet ownership audit

2026-09-23 09:59:15 -07:00

esh-exclude-vm102-from-backup.yaml

chore(esh): exclude VM 102 from the nightly backup job

2026-09-19 05:30:25 -07:00

esh-matter-lxc.yaml

feat(esh-matter): Matter server (matter.js 1.4.0) on a VLAN-90-only LXC for Home Assistant

2026-09-26 13:07:22 -07:00

esh-ml1-restic.yaml

feat(esh-ml1): restic backup of augaman's gallery; augaman v0.1.2

2026-09-27 00:06:33 -07:00

esh-pve-hardware-watchdog.yaml

fix(esh-pve): hardware watchdog, and close the single-resolver DNS SPOF

2026-08-19 09:05:52 -07:00

esh-pve-nas-fix-grub-default.yaml

fix(esh-pve-nas): stop the boot default pinning a single kernel

2026-08-18 06:50:46 -07:00

esh-pve-nas-safe-reboot.yaml

fix(esh-pve-nas): stop the boot default pinning a single kernel

2026-08-18 06:50:46 -07:00

esh-pve-nas-stage-bootloader.yaml

feat(esh-pve-nas): cut PVE root over to ZFS on the mirrored NVMe

2026-08-18 06:39:34 -07:00

esh-pve-nas-stage-zfs-root.yaml

feat(esh-pve-nas): stage the PVE root migration off the USB DOM

2026-08-17 22:11:14 -07:00

esh-vm-db-restic-repair.yaml

playbooks: repoint the four remaining live fv-ml1 targets

2026-09-12 22:04:41 -07:00

fix-esh-nfs-boot-ordering.yaml

fix(esh-nfs): order docker after the NFS mount units directly

2026-07-14 21:53:33 -07:00

fv-ml1-mesh-routes.yaml

fv-ml1: the playbook + homepage body edits the rename commit missed

2026-09-12 22:04:20 -07:00

fv-ml1-overcommit-memory.yaml

fv-ml1: the playbook + homepage body edits the rename commit missed

2026-09-12 22:04:20 -07:00

fv-ml1-pool-health.yaml

fv-ml1: the playbook + homepage body edits the rename commit missed

2026-09-12 22:04:20 -07:00

fv-ml1-training-window-close.yaml

fv-ml1: the playbook + homepage body edits the rename commit missed

2026-09-12 22:04:20 -07:00

fv-ml1-training-window-open.yaml

fv-ml1: the playbook + homepage body edits the rename commit missed

2026-09-12 22:04:20 -07:00

gpu-lxc.yaml

feat(nh3-ml1): second TEI embed/rerank backend live on nh3-pve; parity-verified vs esh-ml1

2026-09-25 15:55:33 -07:00

gx10-headless.yaml

feat(pfi-gx10): register the ASUS Ascent GX10 and convert it to headless

2026-09-01 11:36:49 -07:00

gx10-outfit-privileged.yaml

fix(pfi-gx10): install python3-dev — Triton JIT-compiles C at first use

2026-09-02 00:36:16 -07:00

gx10-rack-network.yaml

feat(gx10): rack networking — VLAN 50 via DHCP reservation, wired only

2026-09-03 15:59:09 -07:00

homepage-regroup-ana-docker.yaml

feat(homepage): recategorise on "do I open this?", collapse the API groups

2026-08-24 08:54:06 -07:00

homepage-regroup-esh-docker-vm.yaml

feat(homepage): recategorise on "do I open this?", collapse the API groups

2026-08-24 08:54:06 -07:00

homepage-regroup-fv-ml1.yaml

playbooks: repoint the four remaining live fv-ml1 targets

2026-09-12 22:04:41 -07:00

homepage-regroup-irv-ml1.yaml

feat(homepage): recategorise on "do I open this?", collapse the API groups

2026-08-24 08:54:06 -07:00

homepage-regroup-nh3-docker.yaml

feat(homepage): recategorise on "do I open this?", collapse the API groups

2026-08-24 08:54:06 -07:00

install-pi-nh3-extdev.yaml

feat(nh3-extdev): install pi (earendil-works) + wire /opt/externs client agents to GLM 5.2

2026-06-18 14:04:29 -07:00

install-potrace-headers.yaml

feat(playbooks): potrace/agg headers, with the two traps that mislead

2026-08-28 13:38:12 -07:00

install-traefik-postboot.yaml

playbooks/install-traefik-postboot: oneshot systemd unit that restarts traefik N seconds after boot

2026-04-26 14:30:02 -07:00

irv-ml1-draupnir-engine.yaml

feat(irv-ml1): provision the Draupnir geometry engine, acceptance-tested

2026-09-21 11:17:41 -07:00

irv-ml1-r15-r16-nosudo.yaml

feat(irv-ml1): R15 + R16 brokkr-smithy probe-harness stand-up playbooks

2026-06-03 14:49:46 -07:00

irv-ml1-r15-r16-sudo.yaml

fix(irv-ml1): self-heal the gcc-11/gfortran-12 -lgfortran mismatch for soundgen

2026-06-03 15:16:13 -07:00

irv-ml1-tailscale-ipv6.yaml

fix(irv-ml1): tailscaled could never add its IPv6 mesh address, and the README described a topology two cutovers old

2026-09-22 08:21:10 -07:00

mog-sec-move-to-gpu0.yaml

playbooks: repoint the four remaining live fv-ml1 targets

2026-09-12 22:04:41 -07:00

nh3-dev-install-sox.yaml

ops(nh3-dev): install sox + libsox-fmt-all for yt-voice-clipper-dev's denoiser bake-off (noisered)

2026-09-09 11:13:54 -07:00

nh3-dev-memory-forensics.yaml

feat(playbooks): nh3-dev memory forensics — and the OOM hog is Claude Code

2026-08-28 06:03:43 -07:00

nh3-extdev-althing-upgrade.yaml

chore(althing): pin the post office to 3.7.0

2026-09-19 06:49:11 -07:00

nh3-extdev-althing-v3.yaml

fix(playbooks): 3.1.1 deploy — and why the markers match presence, not count

2026-08-28 16:15:34 -07:00

nh3-nfs-automount.yaml

fix(nh3): NFS clients mount nh3-nas shares on first access; record guest power-loss expectations

2026-09-24 13:16:18 -07:00

nh3-pve-pin-nic-names.yaml

feat(nh3-pve): prepare for GPU install — pin NIC names by MAC, pull AMT port from vmbr0

2026-09-25 10:56:17 -07:00

normalize-docker-tree.yaml

feat(fleet): normalize docker deploy trees to root:docker setgid

2026-09-14 13:13:56 -07:00

pull-hf-repo.yaml

playbooks: repoint the four remaining live fv-ml1 targets

2026-09-12 22:04:41 -07:00

pve-node-upgrade.yaml

feat(esh-pve-nas): install the 225-package backlog; reboot deferred

2026-08-18 07:21:40 -07:00

pve-nvidia-host.yaml

feat(nh3-ml1): second TEI embed/rerank backend live on nh3-pve; parity-verified vs esh-ml1

2026-09-25 15:55:33 -07:00

remove-autorestic.yaml

playbooks/remove-autorestic: quote the ! in the binary-absent verify (YAML tag indicator)

2026-04-26 14:43:02 -07:00

repin-worldtree-image.yaml

fix(playbooks): compare image IDs, not the created-from tag; make the repin idempotent

2026-08-22 21:52:20 -07:00

restic-repository-file.yaml

fix(restic): stop publishing rest-server passwords in systemd units

2026-09-27 01:51:05 -07:00

searxng-tierA-engines.yaml

chore(searxng): adopt the concurrent v4 work, with its dead mechanism marked

2026-09-18 14:11:58 -07:00

serve-qwen3.5-122b.yaml

playbooks: repoint the four remaining live fv-ml1 targets

2026-09-12 22:04:41 -07:00

tighten-env-perms.yaml

feat(playbooks): sweep world-readable secret-bearing .env files to 0600

2026-08-23 03:09:13 -07:00

update-stack-image.yaml

playbooks: generic per-service stack image update (pull + recreate + verify)

2026-09-16 16:34:16 -07:00

upgrade-docker-ce.yaml

fix(upgrade-docker-ce): retry the stack restart under sudo before reporting FAILED

2026-09-14 12:50:26 -07:00

wire-personal-worldtree-memory-allowlist.yaml

feat(corviduo): wire ratatoskr memory plane :8391 into personal Worldtree bifrost allowlist

2026-06-15 23:22:06 -07:00