[2026-05-23] wiki curation: kraken-network, wireguard-vpn, research queue, log, index
This commit is contained in:
Alexey Martemyanov
@@ -0,0 +1,29 @@
|
|||||||
|
---
|
||||||
|
date: 2026-05-23
|
||||||
|
status: complete
|
||||||
|
---
|
||||||
|
# Proactive Research — 2026-05-23
|
||||||
|
|
||||||
|
## Researched
|
||||||
|
- **Topic:** WireGuard VPN — Eagle to Kraken
|
||||||
|
- **Page:** [[wiki/tech/wireguard-vpn]]
|
||||||
|
- **Confidence:** high
|
||||||
|
- **Key finding:** kraken-network.md had only 3 lines on WireGuard; the actual
|
||||||
|
topology is a two-interface VPS relay with SNAT, a LaunchDaemon auto-connect
|
||||||
|
script on Eagle (StartInterval, not WatchPaths — avoids a DNS race condition),
|
||||||
|
and a scoped /etc/resolver/kraken for Time Machine hostname resolution.
|
||||||
|
|
||||||
|
## Validation fixes
|
||||||
|
- none
|
||||||
|
|
||||||
|
## Gaps found
|
||||||
|
- 3 new items added to research-queue.md (queue was missing — created today)
|
||||||
|
1. Executor Architecture v2 (executor-runner.sh + executor-analyzer.sh)
|
||||||
|
2. Executor Security Incident 2026-05-11 (Asana boundary crossing)
|
||||||
|
|
||||||
|
## Stats
|
||||||
|
- Web searches: 0 (all source material in vault)
|
||||||
|
- Wiki page: created (tech/wireguard-vpn.md)
|
||||||
|
- Pages updated: 1 (tech/kraken-network.md — WireGuard section expanded + link)
|
||||||
|
- Queue remaining: 2
|
||||||
|
- Validation issues fixed: 0
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
---
|
||||||
|
title: Wiki Index
|
||||||
|
updated: '2026-05-23'
|
||||||
|
---
|
||||||
|
|
||||||
|
# Wiki Index
|
||||||
|
|
||||||
|
> Content catalog. Every wiki page listed with a one-line summary.
|
||||||
|
> Read this first to find relevant pages for any query.
|
||||||
|
> Last updated: 2026-05-23 | Total pages: 28
|
||||||
|
|
||||||
|
## Personal OS — Core
|
||||||
|
|
||||||
|
- [[personal-os-purpose]] — Why the system exists; design principles; the four agents
|
||||||
|
- [[personal-os-architecture]] — Full technical architecture: agents, data flow, file locations, DB tables
|
||||||
|
- [[personal-os-agent-rules]] — Eagle's operating rules, knowledge sources, allowed writes, cron schedule
|
||||||
|
- [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system
|
||||||
|
- [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md
|
||||||
|
- [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store
|
||||||
|
|
||||||
|
## Work / DDG
|
||||||
|
|
||||||
|
- [[ddg-asana-workflow]] — DDG Asana conventions: task sources, types, status labels, weekly rhythms
|
||||||
|
|
||||||
|
## Vault & Knowledge Infrastructure
|
||||||
|
|
||||||
|
- [[vault-filling-guide]] — Directory map, file naming, frontmatter conventions, Eagle write protocol
|
||||||
|
- [[wiki-ingest-process]] — Hash-based incremental synthesis: how raw/ files become wiki pages
|
||||||
|
- [[obsidian-mcp-wrapper]] — Proxy wrapper fixing 4 obsidian-mcp bugs (ZodError, race, UTF-8, watchdog)
|
||||||
|
|
||||||
|
## Infrastructure
|
||||||
|
|
||||||
|
- [[htpc-bazzite-proton]] — HTPC Bazzite: Windows game Proton compatibility status and fix recipes
|
||||||
|
|
||||||
|
## Infrastructure — tech/
|
||||||
|
|
||||||
|
- [[tech/wireguard-vpn]] — WireGuard split-tunnel: Eagle↔VPS↔Kraken topology, auto-connect, Time Machine, DNS
|
||||||
|
- [[tech/kraken-network]] — Kraken SSH (192.168.1.15), WireGuard topology, media volume paths
|
||||||
|
- [[tech/gitea-config]] — Gitea URL, user, API endpoint, token (eagle-reflect)
|
||||||
|
- [[tech/vault-namespace]] — Rules for where notes live: namespace assignments, directory map
|
||||||
|
- [[tech/media-pipeline-pitfalls]] — Torrent rename pitfall, torrent-set-location usage
|
||||||
|
- [[tech/htpc-steam-emulators]] — Bazzite HTPC Steam shortcuts, emulator save paths, gamepad config
|
||||||
|
- [[tech/truenas-inpxer]] — Books at /mnt/RED_2TB/storage/books/, inpxer setup
|
||||||
|
- [[tech/jellyfin-config]] — Jellyfin URL, users (alex/lisa), API key, DB stop-first rule
|
||||||
|
- [[tech/arr-stack-kraken]] — Prowlarr→Radarr+Sonarr→Transmission→Jellyfin pipeline + API keys
|
||||||
|
- [[tech/hermes-docker-kraken]] — Hermes runs via docker run (not compose), launch pattern
|
||||||
|
- [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources
|
||||||
|
- [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places
|
||||||
|
- [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location
|
||||||
|
|
||||||
|
## Personal Projects
|
||||||
|
|
||||||
|
- (none yet — Reflect app to be added)
|
||||||
|
|
||||||
|
## Concepts
|
||||||
|
|
||||||
|
- [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer
|
||||||
|
|
||||||
|
## Meta
|
||||||
|
|
||||||
|
- [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions
|
||||||
|
- [[vault-filling-guide]] — Listed above; also describes vault structure
|
||||||
+37
@@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
title: Wiki Log
|
||||||
|
updated: '2026-05-23'
|
||||||
|
type: meta
|
||||||
|
---
|
||||||
|
|
||||||
|
# Wiki Log
|
||||||
|
|
||||||
|
> Chronological record of all wiki actions. Append-only.
|
||||||
|
> Format: `## [YYYY-MM-DD] action | subject`
|
||||||
|
> Actions: ingest, update, query, lint, create, archive, delete, bootstrap
|
||||||
|
> Rotate when this file exceeds 500 entries: rename to log-YYYY.md, start fresh.
|
||||||
|
|
||||||
|
## [2026-04-27] bootstrap | Initial wiki pages from Personal OS docs
|
||||||
|
- Created from raw/ symlinks: personal-os-architecture, personal-os-purpose,
|
||||||
|
personal-os-agent-rules, personal-os-self-modification, personal-os-sync-pipeline,
|
||||||
|
personal-os-schema, ddg-asana-workflow, vault-filling-guide, wiki-ingest-process
|
||||||
|
|
||||||
|
## [2026-05-09] create | obsidian-mcp-wrapper
|
||||||
|
- Documented obsidian-mcp-wrapper.js: 4 bugs fixed, architecture, config
|
||||||
|
|
||||||
|
## [2026-05-13] bootstrap | wiki-curation cron job started on Eagle
|
||||||
|
- Eagle Hermes cron: daily 02:00, skill llm-wiki
|
||||||
|
- WIKI_PATH=~/obsidian/wiki configured
|
||||||
|
|
||||||
|
## [2026-05-23] research | WireGuard VPN topology
|
||||||
|
- Created: tech/wireguard-vpn.md — split-tunnel Eagle↔VPS↔Kraken, auto-connect, Time Machine, DNS
|
||||||
|
- Source: family/how-to/wireguard-vpn.md
|
||||||
|
- Created: research-queue.md with 3 gap items detected
|
||||||
|
- Updated: index.md (count 27→28, added wireguard-vpn entry)
|
||||||
|
|
||||||
|
## [2026-05-23] bootstrap | SCHEMA.md, index.md, log.md created
|
||||||
|
- Navigation files were missing; created with 12 existing pages catalogued
|
||||||
|
- Files created: SCHEMA.md, index.md, log.md
|
||||||
|
- Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md)
|
||||||
|
- Created: concepts/vault-agent-integration.md (synthesis)
|
||||||
|
- Lint: no conflicts, no inbox items, no sessions to crystallize
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
title: Research Queue
|
||||||
|
updated: '2026-05-23'
|
||||||
|
type: meta
|
||||||
|
---
|
||||||
|
|
||||||
|
# Research Queue
|
||||||
|
|
||||||
|
> Topics detected as gaps in the wiki — mentioned in vault but no wiki page.
|
||||||
|
> Ordered by priority. Completed items move to ## Completed with link + date.
|
||||||
|
|
||||||
|
## Queue
|
||||||
|
|
||||||
|
- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema
|
||||||
|
- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory
|
||||||
|
|
||||||
|
## Completed
|
||||||
|
|
||||||
|
- [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23)
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
---
|
||||||
|
title: Kraken Network & Infra
|
||||||
|
created: '2026-05-23'
|
||||||
|
updated: '2026-05-23'
|
||||||
|
type: tech
|
||||||
|
namespace: personal
|
||||||
|
tags: [infra, kraken, ssh, wireguard, network]
|
||||||
|
related: "[[arr-stack-kraken]]"
|
||||||
|
---
|
||||||
|
|
||||||
|
# Kraken Network & Infra
|
||||||
|
|
||||||
|
## SSH Access
|
||||||
|
|
||||||
|
```
|
||||||
|
ssh kraken
|
||||||
|
```
|
||||||
|
|
||||||
|
IP: `192.168.1.15` (wlan0, primary). SSH alias `kraken` resolves via `~/.ssh/config`.
|
||||||
|
|
||||||
|
## WireGuard Topology
|
||||||
|
|
||||||
|
Split-tunnel: Eagle ↔ VPS ↔ Kraken. Full details: [[tech/wireguard-vpn]].
|
||||||
|
|
||||||
|
- Eagle: `10.99.0.2`, Kraken: `10.99.1.2`, VPS relay: `10.99.0.1`/`10.99.1.1`
|
||||||
|
- `wg-auto.sh` on Eagle (LaunchDaemon) — up when off home Wi-Fi, down at home
|
||||||
|
- VPS as relay; two interfaces (wg0/wg1) avoid hairpin forwarding
|
||||||
|
|
||||||
|
## Media Volume Mount Paths
|
||||||
|
|
||||||
|
Docker containers on Kraken mount media from NAS over NFS/SMB.
|
||||||
|
Paths were documented here — check docker-compose files in
|
||||||
|
`/opt/media-toolbox-kraken` for current mount config.
|
||||||
@@ -0,0 +1,120 @@
|
|||||||
|
---
|
||||||
|
title: WireGuard VPN — Eagle to Kraken
|
||||||
|
created: '2026-05-23'
|
||||||
|
updated: '2026-05-23'
|
||||||
|
type: tech
|
||||||
|
namespace: personal
|
||||||
|
tags: [infra, kraken]
|
||||||
|
sources: [family/how-to/wireguard-vpn.md]
|
||||||
|
confidence: high
|
||||||
|
---
|
||||||
|
|
||||||
|
# WireGuard VPN — Eagle to Kraken
|
||||||
|
|
||||||
|
Split-tunnel VPN connecting Eagle (Mac M4, home) to Kraken (RPi5, home) via
|
||||||
|
a VPS relay. Enables SSH to Kraken from anywhere and routes Time Machine
|
||||||
|
backups over the tunnel. Two VPS interfaces avoid hairpin forwarding.
|
||||||
|
|
||||||
|
## Topology
|
||||||
|
|
||||||
|
```
|
||||||
|
Eagle (10.99.0.2) ←→ wg0 VPS (10.99.0.1) ←→ wg1 VPS (10.99.1.1) ←→ Kraken (10.99.1.2)
|
||||||
|
:51820 :51821
|
||||||
|
```
|
||||||
|
|
||||||
|
SNAT rewrites source address: Eagle packets arrive at Kraken with src
|
||||||
|
`10.99.1.1` (VPS wg1), not Eagle's `10.99.0.2`. FORWARD runs wg0→wg1
|
||||||
|
on the VPS with nftables.
|
||||||
|
|
||||||
|
## VPN Addresses
|
||||||
|
|
||||||
|
| Node | VPN IP |
|
||||||
|
|------|--------|
|
||||||
|
| VPS wg0 | 10.99.0.1 |
|
||||||
|
| VPS wg1 | 10.99.1.1 |
|
||||||
|
| Eagle | 10.99.0.2 |
|
||||||
|
| Kraken | 10.99.1.2 |
|
||||||
|
|
||||||
|
`kraken` hostname resolves via dnsmasq on VPS (`DNS = 10.99.0.1` in Eagle's
|
||||||
|
wg0.conf). DNS is scoped to the `kraken` domain only (see DNS section).
|
||||||
|
|
||||||
|
## Persistence
|
||||||
|
|
||||||
|
| Component | Node | How it survives reboot |
|
||||||
|
|-----------|------|------------------------|
|
||||||
|
| wg-quick@wg0 + wg-quick@wg1 | VPS | systemd enabled |
|
||||||
|
| PostUp FORWARD + SNAT rules | VPS | embedded in `/etc/wireguard/wg0.conf` |
|
||||||
|
| nftables (10.99.0.0/16 forward) | VPS | `/etc/nftables.conf`, systemd enabled |
|
||||||
|
| dnsmasq (`kraken` → 10.99.1.2) | VPS | `/etc/dnsmasq.d/vpn-hosts.conf`, systemd enabled |
|
||||||
|
| wg-quick@wg0 | Kraken | systemd enabled |
|
||||||
|
| wg-auto LaunchDaemon | Eagle | `/Library/LaunchDaemons/top.eagle.wg-auto.plist` |
|
||||||
|
|
||||||
|
## Auto-Connect on Eagle
|
||||||
|
|
||||||
|
`/usr/local/bin/wg-auto.sh` polls every 30 seconds via launchd
|
||||||
|
(`StartInterval`, **not** WatchPaths):
|
||||||
|
|
||||||
|
- At home (router MAC `f0:79:59:77:9b:70` visible on ARP) → `wg-quick down`
|
||||||
|
- Off home network → `wg-quick up`
|
||||||
|
|
||||||
|
**Why StartInterval and not WatchPaths:** WatchPaths triggered a race —
|
||||||
|
`wg-quick down` changes DNS via `networksetup`, which writes to
|
||||||
|
`/Library/Preferences/SystemConfiguration/`, which re-fires launchd,
|
||||||
|
tearing the tunnel down immediately after connecting.
|
||||||
|
|
||||||
|
## DNS (Scoped Resolver)
|
||||||
|
|
||||||
|
wg0.conf uses **no global `DNS =`**. PostUp/PostDown manage a
|
||||||
|
macOS scoped resolver for the `kraken` domain only:
|
||||||
|
|
||||||
|
```
|
||||||
|
PostUp = mkdir -p /etc/resolver && \
|
||||||
|
echo "nameserver 10.99.0.1" > /etc/resolver/kraken && \
|
||||||
|
killall -HUP mDNSResponder
|
||||||
|
PostDown = rm -f /etc/resolver/kraken && killall -HUP mDNSResponder
|
||||||
|
```
|
||||||
|
|
||||||
|
Result: only `kraken` resolves via VPS dnsmasq. Global DNS and Wi-Fi IP
|
||||||
|
are untouched — prevents address-bar breakage during tunnel transitions.
|
||||||
|
|
||||||
|
## Time Machine
|
||||||
|
|
||||||
|
| Setting | Value |
|
||||||
|
|---------|-------|
|
||||||
|
| Old destination (broken) | `smb://timemachine@kraken._smb._tcp.local./TimeMachine` |
|
||||||
|
| New destination (working) | `smb://timemachine@kraken/TimeMachine` |
|
||||||
|
|
||||||
|
mDNS (`_smb._tcp.local`) doesn't work off the local LAN. VPN DNS (`kraken`
|
||||||
|
→ 10.99.1.2 via dnsmasq) works from anywhere. Container on Kraken:
|
||||||
|
`mbentley/timemachine:smb`, `restart: unless-stopped`.
|
||||||
|
|
||||||
|
## Public Keys
|
||||||
|
|
||||||
|
| Node | Public Key |
|
||||||
|
|------|------------|
|
||||||
|
| VPS wg0 | `6W6hSw0JFLm0BbyeNp1g7wF7dKKTZmGvPRdir68mz0w=` |
|
||||||
|
| VPS wg1 | `ssRV2497NQ3Lfzvx/FLO0jDlcCXdK/RReJQ36i0yuR8=` |
|
||||||
|
| Eagle | `dDgIjBUNguodOHWoz7iFsImvKhteodHcFWM8mMe4UiE=` |
|
||||||
|
| Kraken | `8kIdCKMIoMsW09/aQX6+pU0SS/rN4PysJL59w17eGRg=` |
|
||||||
|
|
||||||
|
## Diagnostics
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Eagle — check tunnel state
|
||||||
|
sudo wg show
|
||||||
|
ping kraken
|
||||||
|
|
||||||
|
# VPS
|
||||||
|
ssh root@91.207.28.205 "wg show all"
|
||||||
|
|
||||||
|
# Kraken
|
||||||
|
ssh kraken "sudo wg show"
|
||||||
|
|
||||||
|
# Eagle auto-connect log
|
||||||
|
cat /var/log/wg-auto.log
|
||||||
|
```
|
||||||
|
|
||||||
|
## Related
|
||||||
|
|
||||||
|
- [[tech/kraken-network]] — Kraken SSH access, media volume paths
|
||||||
|
- [[personal-os-architecture]] — Eagle hardware, home infra overview
|
||||||
Reference in New Issue
Block a user