[2026-05-23] vault-git-sync: Taiga arch, SSH alias, fix deployed

wiki/tech/vault-git-sync.md

@@ -40,25 +40,25 @@ The correct script for Taiga/Kraken is at `~/scripts/sync-vault-partial.sh` on E
 It uses sparse checkout (only `personal/` and `family/`), which is an additional safeguard:
 if Taiga never checks out `wiki/`, it can never delete wiki/ files even if the script has bugs.
 
-## Taiga Fix (TODO)
+## Taiga Architecture
 
-Taiga runs TrueNAS. The broken script is at `/opt/data/sync-vault.sh`.
+Taiga is TrueNAS running Hermes in Docker (`/mnt/RED_2TB/docker/hermes/`).
+The sync script runs **inside the container** with:
+- `GIT_WORK_TREE=/vault` → mounted from `/mnt/RED_2TB/storage/obsidian`
+- `GIT_DIR=/vault.git` → mounted from `/mnt/RED_2TB/storage/git/obsidian-vault.git` (the bare repo itself)
 
-To fix (requires TrueNAS console or web UI → System → Advanced → Init/Shutdown Scripts):
+Taiga IS the repo — no remote push needed. Eagle pushes to `nas/main`, which is this same bare repo.
 
-1. Copy correct script from Eagle:
-   ```bash
-   scp ~/scripts/sync-vault-partial.sh root@<taiga-ip>:/opt/data/sync-vault.sh
-   ```
-2. On Taiga, ensure vault uses sparse checkout:
-   ```bash
-   cd /path/to/obsidian-vault
-   git config core.sparseCheckout true
-   echo "personal/" > .git/info/sparse-checkout
-   echo "family/" >> .git/info/sparse-checkout
-   git read-tree -mu HEAD
-   ```
-3. Test: `bash /opt/data/sync-vault.sh`
+Script location: `/mnt/RED_2TB/docker/hermes/config/sync-vault.sh` (= `/opt/data/sync-vault.sh` inside container)
+
+SSH access: `ssh taiga` (alias in ~/.ssh/config → `truenas_admin@mallexxx.duckdns.org`)
+
+To deploy a script fix:
+```bash
+scp ~/scripts/sync-vault-taiga.sh taiga:/mnt/RED_2TB/docker/hermes/config/sync-vault.sh
+```
+
+**NEVER use local IP for TrueNAS** — always `mallexxx.duckdns.org` or `ssh taiga`.
 
 ## .gitignore