From 7bec38176d438d3ea6df4c322048d24d5ff1db40 Mon Sep 17 00:00:00 2001 From: Alexey Martemyanov Date: Sat, 23 May 2026 06:01:15 +0600 Subject: [PATCH] [2026-05-23] wiki curation: kraken-network, wireguard-vpn, research queue, log, index --- .../wiki-curation-runs/research-2026-05-23.md | 29 +++++ wiki/index.md | 62 +++++++++ wiki/log.md | 37 ++++++ wiki/research-queue.md | 19 +++ wiki/tech/kraken-network.md | 33 +++++ wiki/tech/wireguard-vpn.md | 120 ++++++++++++++++++ 6 files changed, 300 insertions(+) create mode 100644 personal/projects/personal-os/wiki-curation-runs/research-2026-05-23.md create mode 100644 wiki/index.md create mode 100644 wiki/log.md create mode 100644 wiki/research-queue.md create mode 100644 wiki/tech/kraken-network.md create mode 100644 wiki/tech/wireguard-vpn.md diff --git a/personal/projects/personal-os/wiki-curation-runs/research-2026-05-23.md b/personal/projects/personal-os/wiki-curation-runs/research-2026-05-23.md new file mode 100644 index 00000000..7794b410 --- /dev/null +++ b/personal/projects/personal-os/wiki-curation-runs/research-2026-05-23.md @@ -0,0 +1,29 @@ +--- +date: 2026-05-23 +status: complete +--- +# Proactive Research — 2026-05-23 + +## Researched +- **Topic:** WireGuard VPN — Eagle to Kraken +- **Page:** [[wiki/tech/wireguard-vpn]] +- **Confidence:** high +- **Key finding:** kraken-network.md had only 3 lines on WireGuard; the actual + topology is a two-interface VPS relay with SNAT, a LaunchDaemon auto-connect + script on Eagle (StartInterval, not WatchPaths — avoids a DNS race condition), + and a scoped /etc/resolver/kraken for Time Machine hostname resolution. + +## Validation fixes +- none + +## Gaps found +- 3 new items added to research-queue.md (queue was missing — created today) + 1. Executor Architecture v2 (executor-runner.sh + executor-analyzer.sh) + 2. Executor Security Incident 2026-05-11 (Asana boundary crossing) + +## Stats +- Web searches: 0 (all source material in vault) +- Wiki page: created (tech/wireguard-vpn.md) +- Pages updated: 1 (tech/kraken-network.md — WireGuard section expanded + link) +- Queue remaining: 2 +- Validation issues fixed: 0 diff --git a/wiki/index.md b/wiki/index.md new file mode 100644 index 00000000..17a848ee --- /dev/null +++ b/wiki/index.md @@ -0,0 +1,62 @@ +--- +title: Wiki Index +updated: '2026-05-23' +--- + +# Wiki Index + +> Content catalog. Every wiki page listed with a one-line summary. +> Read this first to find relevant pages for any query. +> Last updated: 2026-05-23 | Total pages: 28 + +## Personal OS — Core + +- [[personal-os-purpose]] — Why the system exists; design principles; the four agents +- [[personal-os-architecture]] — Full technical architecture: agents, data flow, file locations, DB tables +- [[personal-os-agent-rules]] — Eagle's operating rules, knowledge sources, allowed writes, cron schedule +- [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system +- [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md +- [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store + +## Work / DDG + +- [[ddg-asana-workflow]] — DDG Asana conventions: task sources, types, status labels, weekly rhythms + +## Vault & Knowledge Infrastructure + +- [[vault-filling-guide]] — Directory map, file naming, frontmatter conventions, Eagle write protocol +- [[wiki-ingest-process]] — Hash-based incremental synthesis: how raw/ files become wiki pages +- [[obsidian-mcp-wrapper]] — Proxy wrapper fixing 4 obsidian-mcp bugs (ZodError, race, UTF-8, watchdog) + +## Infrastructure + +- [[htpc-bazzite-proton]] — HTPC Bazzite: Windows game Proton compatibility status and fix recipes + +## Infrastructure — tech/ + +- [[tech/wireguard-vpn]] — WireGuard split-tunnel: Eagle↔VPS↔Kraken topology, auto-connect, Time Machine, DNS +- [[tech/kraken-network]] — Kraken SSH (192.168.1.15), WireGuard topology, media volume paths +- [[tech/gitea-config]] — Gitea URL, user, API endpoint, token (eagle-reflect) +- [[tech/vault-namespace]] — Rules for where notes live: namespace assignments, directory map +- [[tech/media-pipeline-pitfalls]] — Torrent rename pitfall, torrent-set-location usage +- [[tech/htpc-steam-emulators]] — Bazzite HTPC Steam shortcuts, emulator save paths, gamepad config +- [[tech/truenas-inpxer]] — Books at /mnt/RED_2TB/storage/books/, inpxer setup +- [[tech/jellyfin-config]] — Jellyfin URL, users (alex/lisa), API key, DB stop-first rule +- [[tech/arr-stack-kraken]] — Prowlarr→Radarr+Sonarr→Transmission→Jellyfin pipeline + API keys +- [[tech/hermes-docker-kraken]] — Hermes runs via docker run (not compose), launch pattern +- [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources +- [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places +- [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location + +## Personal Projects + +- (none yet — Reflect app to be added) + +## Concepts + +- [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer + +## Meta + +- [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions +- [[vault-filling-guide]] — Listed above; also describes vault structure diff --git a/wiki/log.md b/wiki/log.md new file mode 100644 index 00000000..f54a5d3c --- /dev/null +++ b/wiki/log.md @@ -0,0 +1,37 @@ +--- +title: Wiki Log +updated: '2026-05-23' +type: meta +--- + +# Wiki Log + +> Chronological record of all wiki actions. Append-only. +> Format: `## [YYYY-MM-DD] action | subject` +> Actions: ingest, update, query, lint, create, archive, delete, bootstrap +> Rotate when this file exceeds 500 entries: rename to log-YYYY.md, start fresh. + +## [2026-04-27] bootstrap | Initial wiki pages from Personal OS docs +- Created from raw/ symlinks: personal-os-architecture, personal-os-purpose, + personal-os-agent-rules, personal-os-self-modification, personal-os-sync-pipeline, + personal-os-schema, ddg-asana-workflow, vault-filling-guide, wiki-ingest-process + +## [2026-05-09] create | obsidian-mcp-wrapper +- Documented obsidian-mcp-wrapper.js: 4 bugs fixed, architecture, config + +## [2026-05-13] bootstrap | wiki-curation cron job started on Eagle +- Eagle Hermes cron: daily 02:00, skill llm-wiki +- WIKI_PATH=~/obsidian/wiki configured + +## [2026-05-23] research | WireGuard VPN topology +- Created: tech/wireguard-vpn.md — split-tunnel Eagle↔VPS↔Kraken, auto-connect, Time Machine, DNS +- Source: family/how-to/wireguard-vpn.md +- Created: research-queue.md with 3 gap items detected +- Updated: index.md (count 27→28, added wireguard-vpn entry) + +## [2026-05-23] bootstrap | SCHEMA.md, index.md, log.md created +- Navigation files were missing; created with 12 existing pages catalogued +- Files created: SCHEMA.md, index.md, log.md +- Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md) +- Created: concepts/vault-agent-integration.md (synthesis) +- Lint: no conflicts, no inbox items, no sessions to crystallize diff --git a/wiki/research-queue.md b/wiki/research-queue.md new file mode 100644 index 00000000..df53efa4 --- /dev/null +++ b/wiki/research-queue.md @@ -0,0 +1,19 @@ +--- +title: Research Queue +updated: '2026-05-23' +type: meta +--- + +# Research Queue + +> Topics detected as gaps in the wiki — mentioned in vault but no wiki page. +> Ordered by priority. Completed items move to ## Completed with link + date. + +## Queue + +- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema +- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory + +## Completed + +- [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23) diff --git a/wiki/tech/kraken-network.md b/wiki/tech/kraken-network.md new file mode 100644 index 00000000..59f179e7 --- /dev/null +++ b/wiki/tech/kraken-network.md @@ -0,0 +1,33 @@ +--- +title: Kraken Network & Infra +created: '2026-05-23' +updated: '2026-05-23' +type: tech +namespace: personal +tags: [infra, kraken, ssh, wireguard, network] +related: "[[arr-stack-kraken]]" +--- + +# Kraken Network & Infra + +## SSH Access + +``` +ssh kraken +``` + +IP: `192.168.1.15` (wlan0, primary). SSH alias `kraken` resolves via `~/.ssh/config`. + +## WireGuard Topology + +Split-tunnel: Eagle ↔ VPS ↔ Kraken. Full details: [[tech/wireguard-vpn]]. + +- Eagle: `10.99.0.2`, Kraken: `10.99.1.2`, VPS relay: `10.99.0.1`/`10.99.1.1` +- `wg-auto.sh` on Eagle (LaunchDaemon) — up when off home Wi-Fi, down at home +- VPS as relay; two interfaces (wg0/wg1) avoid hairpin forwarding + +## Media Volume Mount Paths + +Docker containers on Kraken mount media from NAS over NFS/SMB. +Paths were documented here — check docker-compose files in +`/opt/media-toolbox-kraken` for current mount config. diff --git a/wiki/tech/wireguard-vpn.md b/wiki/tech/wireguard-vpn.md new file mode 100644 index 00000000..f0efa07c --- /dev/null +++ b/wiki/tech/wireguard-vpn.md @@ -0,0 +1,120 @@ +--- +title: WireGuard VPN — Eagle to Kraken +created: '2026-05-23' +updated: '2026-05-23' +type: tech +namespace: personal +tags: [infra, kraken] +sources: [family/how-to/wireguard-vpn.md] +confidence: high +--- + +# WireGuard VPN — Eagle to Kraken + +Split-tunnel VPN connecting Eagle (Mac M4, home) to Kraken (RPi5, home) via +a VPS relay. Enables SSH to Kraken from anywhere and routes Time Machine +backups over the tunnel. Two VPS interfaces avoid hairpin forwarding. + +## Topology + +``` +Eagle (10.99.0.2) ←→ wg0 VPS (10.99.0.1) ←→ wg1 VPS (10.99.1.1) ←→ Kraken (10.99.1.2) + :51820 :51821 +``` + +SNAT rewrites source address: Eagle packets arrive at Kraken with src +`10.99.1.1` (VPS wg1), not Eagle's `10.99.0.2`. FORWARD runs wg0→wg1 +on the VPS with nftables. + +## VPN Addresses + +| Node | VPN IP | +|------|--------| +| VPS wg0 | 10.99.0.1 | +| VPS wg1 | 10.99.1.1 | +| Eagle | 10.99.0.2 | +| Kraken | 10.99.1.2 | + +`kraken` hostname resolves via dnsmasq on VPS (`DNS = 10.99.0.1` in Eagle's +wg0.conf). DNS is scoped to the `kraken` domain only (see DNS section). + +## Persistence + +| Component | Node | How it survives reboot | +|-----------|------|------------------------| +| wg-quick@wg0 + wg-quick@wg1 | VPS | systemd enabled | +| PostUp FORWARD + SNAT rules | VPS | embedded in `/etc/wireguard/wg0.conf` | +| nftables (10.99.0.0/16 forward) | VPS | `/etc/nftables.conf`, systemd enabled | +| dnsmasq (`kraken` → 10.99.1.2) | VPS | `/etc/dnsmasq.d/vpn-hosts.conf`, systemd enabled | +| wg-quick@wg0 | Kraken | systemd enabled | +| wg-auto LaunchDaemon | Eagle | `/Library/LaunchDaemons/top.eagle.wg-auto.plist` | + +## Auto-Connect on Eagle + +`/usr/local/bin/wg-auto.sh` polls every 30 seconds via launchd +(`StartInterval`, **not** WatchPaths): + +- At home (router MAC `f0:79:59:77:9b:70` visible on ARP) → `wg-quick down` +- Off home network → `wg-quick up` + +**Why StartInterval and not WatchPaths:** WatchPaths triggered a race — +`wg-quick down` changes DNS via `networksetup`, which writes to +`/Library/Preferences/SystemConfiguration/`, which re-fires launchd, +tearing the tunnel down immediately after connecting. + +## DNS (Scoped Resolver) + +wg0.conf uses **no global `DNS =`**. PostUp/PostDown manage a +macOS scoped resolver for the `kraken` domain only: + +``` +PostUp = mkdir -p /etc/resolver && \ + echo "nameserver 10.99.0.1" > /etc/resolver/kraken && \ + killall -HUP mDNSResponder +PostDown = rm -f /etc/resolver/kraken && killall -HUP mDNSResponder +``` + +Result: only `kraken` resolves via VPS dnsmasq. Global DNS and Wi-Fi IP +are untouched — prevents address-bar breakage during tunnel transitions. + +## Time Machine + +| Setting | Value | +|---------|-------| +| Old destination (broken) | `smb://timemachine@kraken._smb._tcp.local./TimeMachine` | +| New destination (working) | `smb://timemachine@kraken/TimeMachine` | + +mDNS (`_smb._tcp.local`) doesn't work off the local LAN. VPN DNS (`kraken` +→ 10.99.1.2 via dnsmasq) works from anywhere. Container on Kraken: +`mbentley/timemachine:smb`, `restart: unless-stopped`. + +## Public Keys + +| Node | Public Key | +|------|------------| +| VPS wg0 | `6W6hSw0JFLm0BbyeNp1g7wF7dKKTZmGvPRdir68mz0w=` | +| VPS wg1 | `ssRV2497NQ3Lfzvx/FLO0jDlcCXdK/RReJQ36i0yuR8=` | +| Eagle | `dDgIjBUNguodOHWoz7iFsImvKhteodHcFWM8mMe4UiE=` | +| Kraken | `8kIdCKMIoMsW09/aQX6+pU0SS/rN4PysJL59w17eGRg=` | + +## Diagnostics + +```bash +# Eagle — check tunnel state +sudo wg show +ping kraken + +# VPS +ssh root@91.207.28.205 "wg show all" + +# Kraken +ssh kraken "sudo wg show" + +# Eagle auto-connect log +cat /var/log/wg-auto.log +``` + +## Related + +- [[tech/kraken-network]] — Kraken SSH access, media volume paths +- [[personal-os-architecture]] — Eagle hardware, home infra overview