[2026-05-23] wiki curation: kraken-network, wireguard-vpn, research queue, log, index
This commit is contained in:
Alexey Martemyanov
@@ -0,0 +1,29 @@
|
||||
---
|
||||
date: 2026-05-23
|
||||
status: complete
|
||||
---
|
||||
# Proactive Research — 2026-05-23
|
||||
|
||||
## Researched
|
||||
- **Topic:** WireGuard VPN — Eagle to Kraken
|
||||
- **Page:** [[wiki/tech/wireguard-vpn]]
|
||||
- **Confidence:** high
|
||||
- **Key finding:** kraken-network.md had only 3 lines on WireGuard; the actual
|
||||
topology is a two-interface VPS relay with SNAT, a LaunchDaemon auto-connect
|
||||
script on Eagle (StartInterval, not WatchPaths — avoids a DNS race condition),
|
||||
and a scoped /etc/resolver/kraken for Time Machine hostname resolution.
|
||||
|
||||
## Validation fixes
|
||||
- none
|
||||
|
||||
## Gaps found
|
||||
- 3 new items added to research-queue.md (queue was missing — created today)
|
||||
1. Executor Architecture v2 (executor-runner.sh + executor-analyzer.sh)
|
||||
2. Executor Security Incident 2026-05-11 (Asana boundary crossing)
|
||||
|
||||
## Stats
|
||||
- Web searches: 0 (all source material in vault)
|
||||
- Wiki page: created (tech/wireguard-vpn.md)
|
||||
- Pages updated: 1 (tech/kraken-network.md — WireGuard section expanded + link)
|
||||
- Queue remaining: 2
|
||||
- Validation issues fixed: 0
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
title: Wiki Index
|
||||
updated: '2026-05-23'
|
||||
---
|
||||
|
||||
# Wiki Index
|
||||
|
||||
> Content catalog. Every wiki page listed with a one-line summary.
|
||||
> Read this first to find relevant pages for any query.
|
||||
> Last updated: 2026-05-23 | Total pages: 28
|
||||
|
||||
## Personal OS — Core
|
||||
|
||||
- [[personal-os-purpose]] — Why the system exists; design principles; the four agents
|
||||
- [[personal-os-architecture]] — Full technical architecture: agents, data flow, file locations, DB tables
|
||||
- [[personal-os-agent-rules]] — Eagle's operating rules, knowledge sources, allowed writes, cron schedule
|
||||
- [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system
|
||||
- [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md
|
||||
- [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store
|
||||
|
||||
## Work / DDG
|
||||
|
||||
- [[ddg-asana-workflow]] — DDG Asana conventions: task sources, types, status labels, weekly rhythms
|
||||
|
||||
## Vault & Knowledge Infrastructure
|
||||
|
||||
- [[vault-filling-guide]] — Directory map, file naming, frontmatter conventions, Eagle write protocol
|
||||
- [[wiki-ingest-process]] — Hash-based incremental synthesis: how raw/ files become wiki pages
|
||||
- [[obsidian-mcp-wrapper]] — Proxy wrapper fixing 4 obsidian-mcp bugs (ZodError, race, UTF-8, watchdog)
|
||||
|
||||
## Infrastructure
|
||||
|
||||
- [[htpc-bazzite-proton]] — HTPC Bazzite: Windows game Proton compatibility status and fix recipes
|
||||
|
||||
## Infrastructure — tech/
|
||||
|
||||
- [[tech/wireguard-vpn]] — WireGuard split-tunnel: Eagle↔VPS↔Kraken topology, auto-connect, Time Machine, DNS
|
||||
- [[tech/kraken-network]] — Kraken SSH (192.168.1.15), WireGuard topology, media volume paths
|
||||
- [[tech/gitea-config]] — Gitea URL, user, API endpoint, token (eagle-reflect)
|
||||
- [[tech/vault-namespace]] — Rules for where notes live: namespace assignments, directory map
|
||||
- [[tech/media-pipeline-pitfalls]] — Torrent rename pitfall, torrent-set-location usage
|
||||
- [[tech/htpc-steam-emulators]] — Bazzite HTPC Steam shortcuts, emulator save paths, gamepad config
|
||||
- [[tech/truenas-inpxer]] — Books at /mnt/RED_2TB/storage/books/, inpxer setup
|
||||
- [[tech/jellyfin-config]] — Jellyfin URL, users (alex/lisa), API key, DB stop-first rule
|
||||
- [[tech/arr-stack-kraken]] — Prowlarr→Radarr+Sonarr→Transmission→Jellyfin pipeline + API keys
|
||||
- [[tech/hermes-docker-kraken]] — Hermes runs via docker run (not compose), launch pattern
|
||||
- [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources
|
||||
- [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places
|
||||
- [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location
|
||||
|
||||
## Personal Projects
|
||||
|
||||
- (none yet — Reflect app to be added)
|
||||
|
||||
## Concepts
|
||||
|
||||
- [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer
|
||||
|
||||
## Meta
|
||||
|
||||
- [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions
|
||||
- [[vault-filling-guide]] — Listed above; also describes vault structure
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
---
|
||||
title: Wiki Log
|
||||
updated: '2026-05-23'
|
||||
type: meta
|
||||
---
|
||||
|
||||
# Wiki Log
|
||||
|
||||
> Chronological record of all wiki actions. Append-only.
|
||||
> Format: `## [YYYY-MM-DD] action | subject`
|
||||
> Actions: ingest, update, query, lint, create, archive, delete, bootstrap
|
||||
> Rotate when this file exceeds 500 entries: rename to log-YYYY.md, start fresh.
|
||||
|
||||
## [2026-04-27] bootstrap | Initial wiki pages from Personal OS docs
|
||||
- Created from raw/ symlinks: personal-os-architecture, personal-os-purpose,
|
||||
personal-os-agent-rules, personal-os-self-modification, personal-os-sync-pipeline,
|
||||
personal-os-schema, ddg-asana-workflow, vault-filling-guide, wiki-ingest-process
|
||||
|
||||
## [2026-05-09] create | obsidian-mcp-wrapper
|
||||
- Documented obsidian-mcp-wrapper.js: 4 bugs fixed, architecture, config
|
||||
|
||||
## [2026-05-13] bootstrap | wiki-curation cron job started on Eagle
|
||||
- Eagle Hermes cron: daily 02:00, skill llm-wiki
|
||||
- WIKI_PATH=~/obsidian/wiki configured
|
||||
|
||||
## [2026-05-23] research | WireGuard VPN topology
|
||||
- Created: tech/wireguard-vpn.md — split-tunnel Eagle↔VPS↔Kraken, auto-connect, Time Machine, DNS
|
||||
- Source: family/how-to/wireguard-vpn.md
|
||||
- Created: research-queue.md with 3 gap items detected
|
||||
- Updated: index.md (count 27→28, added wireguard-vpn entry)
|
||||
|
||||
## [2026-05-23] bootstrap | SCHEMA.md, index.md, log.md created
|
||||
- Navigation files were missing; created with 12 existing pages catalogued
|
||||
- Files created: SCHEMA.md, index.md, log.md
|
||||
- Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md)
|
||||
- Created: concepts/vault-agent-integration.md (synthesis)
|
||||
- Lint: no conflicts, no inbox items, no sessions to crystallize
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
title: Research Queue
|
||||
updated: '2026-05-23'
|
||||
type: meta
|
||||
---
|
||||
|
||||
# Research Queue
|
||||
|
||||
> Topics detected as gaps in the wiki — mentioned in vault but no wiki page.
|
||||
> Ordered by priority. Completed items move to ## Completed with link + date.
|
||||
|
||||
## Queue
|
||||
|
||||
- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema
|
||||
- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory
|
||||
|
||||
## Completed
|
||||
|
||||
- [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23)
|
||||
@@ -0,0 +1,33 @@
|
||||
---
|
||||
title: Kraken Network & Infra
|
||||
created: '2026-05-23'
|
||||
updated: '2026-05-23'
|
||||
type: tech
|
||||
namespace: personal
|
||||
tags: [infra, kraken, ssh, wireguard, network]
|
||||
related: "[[arr-stack-kraken]]"
|
||||
---
|
||||
|
||||
# Kraken Network & Infra
|
||||
|
||||
## SSH Access
|
||||
|
||||
```
|
||||
ssh kraken
|
||||
```
|
||||
|
||||
IP: `192.168.1.15` (wlan0, primary). SSH alias `kraken` resolves via `~/.ssh/config`.
|
||||
|
||||
## WireGuard Topology
|
||||
|
||||
Split-tunnel: Eagle ↔ VPS ↔ Kraken. Full details: [[tech/wireguard-vpn]].
|
||||
|
||||
- Eagle: `10.99.0.2`, Kraken: `10.99.1.2`, VPS relay: `10.99.0.1`/`10.99.1.1`
|
||||
- `wg-auto.sh` on Eagle (LaunchDaemon) — up when off home Wi-Fi, down at home
|
||||
- VPS as relay; two interfaces (wg0/wg1) avoid hairpin forwarding
|
||||
|
||||
## Media Volume Mount Paths
|
||||
|
||||
Docker containers on Kraken mount media from NAS over NFS/SMB.
|
||||
Paths were documented here — check docker-compose files in
|
||||
`/opt/media-toolbox-kraken` for current mount config.
|
||||
@@ -0,0 +1,120 @@
|
||||
---
|
||||
title: WireGuard VPN — Eagle to Kraken
|
||||
created: '2026-05-23'
|
||||
updated: '2026-05-23'
|
||||
type: tech
|
||||
namespace: personal
|
||||
tags: [infra, kraken]
|
||||
sources: [family/how-to/wireguard-vpn.md]
|
||||
confidence: high
|
||||
---
|
||||
|
||||
# WireGuard VPN — Eagle to Kraken
|
||||
|
||||
Split-tunnel VPN connecting Eagle (Mac M4, home) to Kraken (RPi5, home) via
|
||||
a VPS relay. Enables SSH to Kraken from anywhere and routes Time Machine
|
||||
backups over the tunnel. Two VPS interfaces avoid hairpin forwarding.
|
||||
|
||||
## Topology
|
||||
|
||||
```
|
||||
Eagle (10.99.0.2) ←→ wg0 VPS (10.99.0.1) ←→ wg1 VPS (10.99.1.1) ←→ Kraken (10.99.1.2)
|
||||
:51820 :51821
|
||||
```
|
||||
|
||||
SNAT rewrites source address: Eagle packets arrive at Kraken with src
|
||||
`10.99.1.1` (VPS wg1), not Eagle's `10.99.0.2`. FORWARD runs wg0→wg1
|
||||
on the VPS with nftables.
|
||||
|
||||
## VPN Addresses
|
||||
|
||||
| Node | VPN IP |
|
||||
|------|--------|
|
||||
| VPS wg0 | 10.99.0.1 |
|
||||
| VPS wg1 | 10.99.1.1 |
|
||||
| Eagle | 10.99.0.2 |
|
||||
| Kraken | 10.99.1.2 |
|
||||
|
||||
`kraken` hostname resolves via dnsmasq on VPS (`DNS = 10.99.0.1` in Eagle's
|
||||
wg0.conf). DNS is scoped to the `kraken` domain only (see DNS section).
|
||||
|
||||
## Persistence
|
||||
|
||||
| Component | Node | How it survives reboot |
|
||||
|-----------|------|------------------------|
|
||||
| wg-quick@wg0 + wg-quick@wg1 | VPS | systemd enabled |
|
||||
| PostUp FORWARD + SNAT rules | VPS | embedded in `/etc/wireguard/wg0.conf` |
|
||||
| nftables (10.99.0.0/16 forward) | VPS | `/etc/nftables.conf`, systemd enabled |
|
||||
| dnsmasq (`kraken` → 10.99.1.2) | VPS | `/etc/dnsmasq.d/vpn-hosts.conf`, systemd enabled |
|
||||
| wg-quick@wg0 | Kraken | systemd enabled |
|
||||
| wg-auto LaunchDaemon | Eagle | `/Library/LaunchDaemons/top.eagle.wg-auto.plist` |
|
||||
|
||||
## Auto-Connect on Eagle
|
||||
|
||||
`/usr/local/bin/wg-auto.sh` polls every 30 seconds via launchd
|
||||
(`StartInterval`, **not** WatchPaths):
|
||||
|
||||
- At home (router MAC `f0:79:59:77:9b:70` visible on ARP) → `wg-quick down`
|
||||
- Off home network → `wg-quick up`
|
||||
|
||||
**Why StartInterval and not WatchPaths:** WatchPaths triggered a race —
|
||||
`wg-quick down` changes DNS via `networksetup`, which writes to
|
||||
`/Library/Preferences/SystemConfiguration/`, which re-fires launchd,
|
||||
tearing the tunnel down immediately after connecting.
|
||||
|
||||
## DNS (Scoped Resolver)
|
||||
|
||||
wg0.conf uses **no global `DNS =`**. PostUp/PostDown manage a
|
||||
macOS scoped resolver for the `kraken` domain only:
|
||||
|
||||
```
|
||||
PostUp = mkdir -p /etc/resolver && \
|
||||
echo "nameserver 10.99.0.1" > /etc/resolver/kraken && \
|
||||
killall -HUP mDNSResponder
|
||||
PostDown = rm -f /etc/resolver/kraken && killall -HUP mDNSResponder
|
||||
```
|
||||
|
||||
Result: only `kraken` resolves via VPS dnsmasq. Global DNS and Wi-Fi IP
|
||||
are untouched — prevents address-bar breakage during tunnel transitions.
|
||||
|
||||
## Time Machine
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| Old destination (broken) | `smb://timemachine@kraken._smb._tcp.local./TimeMachine` |
|
||||
| New destination (working) | `smb://timemachine@kraken/TimeMachine` |
|
||||
|
||||
mDNS (`_smb._tcp.local`) doesn't work off the local LAN. VPN DNS (`kraken`
|
||||
→ 10.99.1.2 via dnsmasq) works from anywhere. Container on Kraken:
|
||||
`mbentley/timemachine:smb`, `restart: unless-stopped`.
|
||||
|
||||
## Public Keys
|
||||
|
||||
| Node | Public Key |
|
||||
|------|------------|
|
||||
| VPS wg0 | `6W6hSw0JFLm0BbyeNp1g7wF7dKKTZmGvPRdir68mz0w=` |
|
||||
| VPS wg1 | `ssRV2497NQ3Lfzvx/FLO0jDlcCXdK/RReJQ36i0yuR8=` |
|
||||
| Eagle | `dDgIjBUNguodOHWoz7iFsImvKhteodHcFWM8mMe4UiE=` |
|
||||
| Kraken | `8kIdCKMIoMsW09/aQX6+pU0SS/rN4PysJL59w17eGRg=` |
|
||||
|
||||
## Diagnostics
|
||||
|
||||
```bash
|
||||
# Eagle — check tunnel state
|
||||
sudo wg show
|
||||
ping kraken
|
||||
|
||||
# VPS
|
||||
ssh root@91.207.28.205 "wg show all"
|
||||
|
||||
# Kraken
|
||||
ssh kraken "sudo wg show"
|
||||
|
||||
# Eagle auto-connect log
|
||||
cat /var/log/wg-auto.log
|
||||
```
|
||||
|
||||
## Related
|
||||
|
||||
- [[tech/kraken-network]] — Kraken SSH access, media volume paths
|
||||
- [[personal-os-architecture]] — Eagle hardware, home infra overview
|
||||
Reference in New Issue
Block a user