chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned). Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md (nodes/ports/known-issues), agent definitions. Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief, tls-options and security-headers Traefik config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 11:19:21 -05:00
parent 47ac49a039
commit 27f6d95bf6
34 changed files with 8589 additions and 322 deletions
@@ -6,24 +6,13 @@ services:
    ports:
      - "5678:5678"
    environment:
-      - DB_TYPE=postgresdb
-      - DB_POSTGRESDB_HOST=n8n-db
-      - DB_POSTGRESDB_PORT=5432
-      - DB_POSTGRESDB_DATABASE=n8n
-      - DB_POSTGRESDB_USER=n8n
-      - DB_POSTGRESDB_PASSWORD=${N8N_DB_PASSWORD}
-      - N8N_PORT=5678
      - GENERIC_TIMEZONE=America/Chicago
-      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
+      - N8N_SECURE_COOKIE=false
+      - NODE_OPTIONS=--max-old-space-size=1500
    volumes:
-      - /mnt/docker-data/configs/n8n:/home/node/.n8n
-    depends_on:
-      n8n-db:
-        condition: service_healthy
-    networks:
-      - n8n-internal
-    mem_limit: 512M
-    memswap_limit: 512M
+      - n8n_data:/home/node/.n8n
+    mem_limit: 2g
+    memswap_limit: 2g
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:5678/healthz || exit 1"]
      interval: 30s
@@ -36,35 +25,6 @@ services:
        max-size: "50m"
        max-file: "3"

-  n8n-db:
-    image: postgres:15-alpine
-    container_name: n8n-db
-    restart: unless-stopped
-    user: "1024:100"
-    environment:
-      - POSTGRES_DB=n8n
-      - POSTGRES_USER=n8n
-      - POSTGRES_PASSWORD=${N8N_DB_PASSWORD}
-    volumes:
-      - /mnt/docker-data/databases/n8n-db:/var/lib/postgresql/data
-    networks:
-      - n8n-internal
-    labels:
-      - "com.centurylinklabs.watchtower.enable=false"
-    mem_limit: 256M
-    memswap_limit: 256M
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U n8n -d n8n"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-
-networks:
-  n8n-internal:
-    driver: bridge
+volumes:
+  n8n_data:
+    external: true
@@ -1,2 +0,0 @@
-ANTHROPIC_API_KEY=sk-ant-...
-MATRIX_ACCESS_TOKEN=syt_...
@@ -1,38 +0,0 @@
-FROM node:20-bookworm
-
-# Install system dependencies
-RUN apt-get update && apt-get install -y \
-    python3 python3-pip python3-venv python3-full \
-    git curl jq openssh-client iputils-ping net-tools \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install uv (Python package manager used by some MCP servers)
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.local/bin:$PATH"
-
-# Install OpenClaw globally
-RUN npm install -g openclaw@latest
-
-# Clone NetClaw
-WORKDIR /opt/netclaw
-RUN git clone https://github.com/automateyournetwork/netclaw.git .
-
-# Create openclaw home directory
-RUN mkdir -p /root/.openclaw/workspace
-
-# Copy NetClaw workspace config into openclaw home
-RUN cp -r workspace/skills /root/.openclaw/workspace/ 2>/dev/null || true
-RUN cp config/openclaw.json /root/.openclaw/openclaw.json 2>/dev/null || true
-
-# Install Python dependencies for core MCP servers
-RUN python3 -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-RUN pip install --no-cache-dir pyats genie netmiko paramiko requests pyyaml jinja2 2>/dev/null || true
-
-# Create entrypoint script
-COPY entrypoint.sh /opt/entrypoint.sh
-RUN chmod +x /opt/entrypoint.sh
-
-EXPOSE 1179
-
-ENTRYPOINT ["/opt/entrypoint.sh"]
@@ -1,20 +0,0 @@
-services:
-  netclaw:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    container_name: netclaw-aaron
-    restart: unless-stopped
-    environment:
-      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
-      - MATRIX_ACCESS_TOKEN=${MATRIX_ACCESS_TOKEN}
-      - MATRIX_HOMESERVER=http://192.168.86.192:8008
-    volumes:
-      - /mnt/docker-data/configs/netclaw:/root/.openclaw/data
-    mem_limit: 2G
-    memswap_limit: 2G
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
@@ -1,72 +0,0 @@
-#!/bin/bash
-set -e
-
-# Configure OpenClaw environment
-mkdir -p /root/.openclaw
-
-# Write .env with API key
-cat > /root/.openclaw/.env << EOF
-ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
-EOF
-
-# Write openclaw config for gateway mode
-cat > /root/.openclaw/openclaw.json << 'OCEOF'
-{
-  "mode": "gateway",
-  "provider": "anthropic",
-  "model": "claude-sonnet-4-6",
-  "fallbackModel": "claude-haiku-4-5-20251001",
-  "name": "Aaron",
-  "identity": "Aaron - NetClaw AI Network Engineering Agent"
-}
-OCEOF
-
-# Copy workspace skills if they exist
-if [ -d /opt/netclaw/workspace/skills ]; then
-    cp -r /opt/netclaw/workspace/skills /root/.openclaw/workspace/ 2>/dev/null || true
-fi
-
-# Copy personality/identity docs
-for doc in SOUL.md AGENTS.md IDENTITY.md USER.md TOOLS.md; do
-    if [ -f /opt/netclaw/$doc ]; then
-        cp /opt/netclaw/$doc /root/.openclaw/ 2>/dev/null || true
-    fi
-done
-
-# Send Matrix DM to Jeremy to announce availability
-if [ -n "$MATRIX_ACCESS_TOKEN" ] && [ -n "$MATRIX_HOMESERVER" ]; then
-    echo "Sending Matrix DM to Jeremy..."
-
-    # Create a direct message room with Jeremy
-    ROOM_RESPONSE=$(curl -sf -X POST "${MATRIX_HOMESERVER}/_matrix/client/r0/createRoom" \
-        -H "Content-Type: application/json" \
-        -H "Authorization: Bearer ${MATRIX_ACCESS_TOKEN}" \
-        -d "{
-            \"is_direct\": true,
-            \"invite\": [\"@jeremy:hobbs.farm\"],
-            \"preset\": \"trusted_private_chat\"
-        }" 2>/dev/null || echo "")
-
-    ROOM_ID=$(echo "$ROOM_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('room_id',''))" 2>/dev/null || echo "")
-
-    if [ -n "$ROOM_ID" ]; then
-        # Send the message
-        curl -sf -X PUT "${MATRIX_HOMESERVER}/_matrix/client/r0/rooms/${ROOM_ID}/send/m.room.message/$(date +%s%N)" \
-            -H "Content-Type: application/json" \
-            -H "Authorization: Bearer ${MATRIX_ACCESS_TOKEN}" \
-            -d "{
-                \"msgtype\": \"m.text\",
-                \"body\": \"Hey Jeremy - Aaron here. I'm online and ready to help with network engineering tasks. I'm running NetClaw with CCIE-level networking skills. Ask me about device health checks, routing analysis, security audits, or anything network-related.\"
-            }" 2>/dev/null || echo "Failed to send DM"
-        echo "DM sent to @jeremy:hobbs.farm in room $ROOM_ID"
-    else
-        echo "Warning: Could not create DM room with Jeremy. Response: $ROOM_RESPONSE"
-    fi
-fi
-
-# Start OpenClaw gateway
-echo "Starting NetClaw (Aaron) gateway..."
-exec openclaw gateway 2>&1 || {
-    echo "OpenClaw gateway failed to start, keeping container alive for debugging..."
-    tail -f /dev/null
-}
@@ -5,6 +5,8 @@ http:
      service: yoda
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers-allow-frames
      tls:
        certResolver: letsencrypt

@@ -13,6 +15,8 @@ http:
      service: mess
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers
      tls:
        certResolver: letsencrypt

@@ -21,6 +25,8 @@ http:
      service: mess
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers
      tls:
        certResolver: letsencrypt

@@ -29,6 +35,8 @@ http:
      service: wellknown
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers
      tls:
        certResolver: letsencrypt

@@ -37,6 +45,8 @@ http:
      service: solo
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers-allow-frames
      tls:
        certResolver: letsencrypt

@@ -45,6 +55,8 @@ http:
      service: vault
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers
      tls:
        certResolver: letsencrypt

@@ -53,9 +65,41 @@ http:
      service: git
      entryPoints:
        - websecure
+      middlewares:
+        - security-headers
      tls:
        certResolver: letsencrypt

+  middlewares:
+    security-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    security-headers-allow-frames:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        contentTypeNosniff: true
+        frameDeny: false
+        customFrameOptionsValue: "SAMEORIGIN"
+        referrerPolicy: "strict-origin-when-cross-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
  services:
    yoda:
      loadBalancer:
@@ -6,6 +6,7 @@ services:
    environment:
      - DOMAIN=https://vault.hobbs.farm
      - SIGNUPS_ALLOWED=false
+      - ADMIN_TOKEN=${ADMIN_TOKEN}
    volumes:
      - /mnt/docker-data/configs/vaultwarden:/data
    ports: