- Admin TVs tab: wake time/days, YouTube Music playlist, Shield volume per TV,
pushed via 5-min TV check-ins (/api/tv/config, /api/tv/report, LAN-only)
- com.dayline.photos 1.2.1: MorningActivity (screen on, volume, playlist),
calendar alarm at wake time, Doze-safe chained check-ins
- Both TVs configured for 06:30 daily with the family playlist
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
- shield/photos-source: launcher tile + DreamService screensaver showing /photo
(locked-down WebView, default URL baked in, files/base_url override)
- build-photos-apk.sh: containerized build on hf-pdocker-02 (JDK17, SDK 35);
signing key kept off-repo on .100 + NAS
- Hobbs-Family-Photos-1.0.apk installed on .186 (canary) and set as its screensaver
- Prometheus probes for /api/health and /api/health/photos; Farm Manager links + group
- CLAUDE.md: .100 left the stale Swarm and its NFS mount waits for network (11-03 outage)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
- /photo full-screen slideshow (crossfade, blurred backdrop or fill, shuffle, date)
- admin Photos tab: add shared-album links (check, sync now, status/stale warnings),
slideshow options, browser-resized uploads
- 6-hourly album sync scraping the share page (Library API no longer exposes
user albums), caches 1920px + 64px copies in /data/photos
- /api/health/photos -> 503 when an album has not synced for 48h
- history/restore covers photo settings; min admin password length 6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
- hermes: pin nousresearch/hermes-agent:v2026.8.18 (was :latest, a
rolling dev build that Watchtower never re-pulled -> 7 weeks stale).
- llamacpp: add compose for the llama.cpp inference backend serving
hermes on .150:8081 (q8_0 KV cache; 2.4x ollama on the same GGUF).
- ai-agents: add reconstructed, version-pinned Dockerfiles for margaret
and spirit (openclaw was built from @latest with no Dockerfile stored).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Remove duplicate unifi-os-server container from .100; sole UniFi
controller is now the .150 Podman instance (UI :11443, inform :8080).
Data preserved; compose dir kept.
- Document STP root-cause/fix for wifi client drops: version mismatch
(stp vs rstp) + default priorities -> root flapping; fixed by RSTP
everywhere + .159 pinned root @4096.
- Known Issue #20: correct the stale .100:11443 blackbox probe note -
the probe DID exist in the live config and was removed 2026-10-06
(backup saved) + Prometheus reloaded; UnifiDeviceDown rule is inert.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Synapse DB history rewritten (SQLite -> local -> PostgreSQL, and why)
- #27: Synapse no longer serves /login; Traefik compat routing is load-bearing
- #28: MAS tags are not v-prefixed; distroless; /health only on :8021
- #29: MAS signing keys need a vault home (vault currently locked out)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
org.matrix.msc4108 = True (was False); rendezvous endpoint live (400 not 404).
msc4388_mode: authenticated so unauthenticated internet parties cannot open
rendezvous sessions. All bots syncing, 0 errors.
New containers total ~263MB (mas 39MB, mas-db 40MB, synapse-db 184MB).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Under MAS, Synapse returns M_UNRECOGNIZED for the login endpoints, so the
mess-auth-compat router (priority 1000) sends /_matrix/client/*/login,
/logout and /refresh to MAS while everything else stays on Synapse.
Cloudflare A record for auth.hobbs.farm already existed (98.160.103.126,
DNS-only). Blackbox probes added for MAS internal health (:8021) and the
public discovery endpoint; all four matrix-related probes UP.
Snapshot of the node's traefik dynamic config committed for reference.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Verified: auth_metadata 200, migrated password authenticates via MAS compat
layer, migrated access tokens still valid against Synapse, all bots syncing.
Downtime 55s (20:09:17Z-20:10:12Z).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Config at /mnt/docker-data/configs/mas/config.yaml (node-only, holds signing keys).
Health on :8021 (distroless image - no container healthcheck possible).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Node-side config change; homeserver.yaml is not tracked in the repo.
Downtime 2m35s. SQLite file retained inert at /var/lib/synapse/homeserver.db.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jellyfin lockups root-caused to jellyfin.db (WAL mode) on NFS: SQLite
"database is locked" errors escalated 22->33->125/day, with DB commands
blocking 60-102s, causing healthcheck flaps and playback stalls. Config
rsynced from /mnt/docker-data/configs/jellyfin to local /var/lib/jellyfin
on bart; healthy after redeploy. jellyfin:2026060106 v12 image pin
unchanged. Old NFS copy left in place as backup.
OpenVAS fully removed from bart per user (~39GB reclaimed: containers,
volumes incl. PG DB, image). Prometheus probe and Farm Manager link
removed. Compose dir kept for reference; Known Issue #21 marked moot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 2026-07-13 media redeploy overwrote a node-side pin with the repo's
:latest (10.11.x), downgrading jellyfin under its v12-migrated DB and
breaking Resume/home queries ('no such column: b.ExtraIds'). Repinned;
do not unpin until official stable >= 12.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
nzbhydra2 was the 4th victim of the 2026-07-12 power-event stale NFS locks
(H2 'file is locked' retry loop; the earlier mem bump was a red herring).
Farm Manager links updated (AdGuard/Actual Budget/Portainer removed, UniFi
-> :11443) and image rebuilt; links maintenance is now checklist item 5.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
clip-service: container+volumes+compose removed, ~2GB RAM freed; frigate-notify
config never referenced it. Actual Budget: container+compose removed, data kept
at /mnt/docker-data/configs/actual-budget. Prometheus probes for both removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Backs the Obsidian 'Second Brain' vault (private repo: git.hobbs.farm/jeremy/
second-brain) with self-hosted multi-device sync. LAN-only for now; no public
Traefik route yet.
- couchdb:3.4 pinned, Watchtower disabled, mem_limit 1g.
- Data on LOCAL disk (/var/lib/couchdb) -- CouchDB file locking breaks over
NFSv3, same class as guacamole-db and semaphore-db.
- local.ini mounted READ-WRITE, deliberately: CouchDB 3.x writes runtime config
back into the last-loaded ini, and with :ro it exits 1 and logs NOTHING --
a silent crash-loop that is very hard to diagnose.
- CORS allows app://obsidian.md and capacitor://localhost (LiveSync desktop +
mobile origins); a wildcard origin is not allowed alongside credentials.
- require_valid_user everywhere EXCEPT /_up, so the blackbox probe can health
check it without credentials. Anonymous callers get 401 on all data.
- Admin credentials in Vaultwarden ('CouchDB - Obsidian LiveSync'); .env is
gitignored, .env.example carries a placeholder.
Prometheus probe added (probe_success=1). Vault database: 'secondbrain'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Evaluated and torn down at the user's request. Container, image, source
(/opt/lifeos), SQLite data (/var/lib/lifeos) and compose dir removed from
hf-pdocker-02; Prometheus probe removed and both instances reloaded; port
8095 released.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The container served a blank page. Four upstream assumptions broke a
root-served, Supabase-less deployment; all are patched at build time with
grep assertions so a silent upstream rename fails the build instead of
shipping a blank page again.
- React Router was pinned to basename '/app' (upstream is hosted under an
/app path). At '/' it matched no route and rendered nothing -- silently,
with only a console warning. This was the blank page.
- supabase.ts calls createClient() at module scope, which throws
'supabaseUrl is required' on an empty string and killed the bundle before
React mounted. Dummy values fix it; nothing reads Supabase in local mode.
- initAuth() only booted the local user for Tauri/Electron, so a browser
build fell through to a Supabase login screen the backend cannot serve
(it has no /api/auth/login or /api/auth/signup -- it is single-user).
- The local API adapter has no realtime layer, so supabase.channel() was
undefined and every subscribing component tripped the ErrorBoundary
('Something went wrong'). Added no-op stubs; realtime is meaningless on a
single-user instance.
Verified in a browser: dashboard and routed pages render, 0 fatal errors.
Known gap: the Flask backend implements only a subset of the cloud schema,
so quests, messages, partnerships, grocery_lists, recurring_transactions,
junction_traditions and habit_suggestions 404. Non-fatal; those features
degrade. Core (tasks/habits/goals/health/finance/journal/XP/AI chat) works.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The unanchored pattern also swallowed compose/hf-pdocker-01/friday-voice/.
Only the top-level nested repo should be ignored.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Post-Swarm: node-exporter must run standalone with pid:host, since Swarm mode
blocked it and cross-node /proc namespaces contaminated swap metrics. Marks the
stacks/ definition superseded.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
FRIDAY Voice (speaches GPU STT/TTS + hermes agent + push-to-talk console) on
.150 Docker Desktop, fronted by coach.hobbs.farm. Also captures the VoiceCoach
compose/agent trees and deploy notes it replaced, which had never been committed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Splits the single main.py into config/database/models/routes/vision/recognition/
ollama_client/cleanup modules, adds a web UI, and introduces clip-service for
CLIP (ViT-L-14) embeddings.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Self-hosted LifeOS (github.com/lifeos-app/lifeos, pinned 3009bf6) in local
mode: no Supabase. Multi-stage build - Node builds the Vite bundle, gunicorn
serves it plus the bundled Flask/SQLite API from one process.
LAN-only on purpose: the backend is single-user with no auth, so anyone who
reaches the port has full read/write. Needs Traefik basicAuth before it can
ever be exposed publicly.
Two upstream bugs patched via sed (build fails loudly if they are renamed):
the chat model was hardcoded to the author's private 'sentient-teddy' bridge,
and a hardcoded 30s timeout failed every first message because Ollama needs
~46s to cold-load the model (0.7s warm). Both are env vars now.
SQLite stays on local disk - NFSv3 breaks WAL locking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
.playwright-mcp/ and .superpowers/ hold browser console dumps and brainstorm
session state. friday-voice/ is a separate Gitea repo and would otherwise be
committed here as a dangling gitlink.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Routes claude-opus-4-8, gpt-5.5, qwen2.5:14b, llama3.1:8b through a
single OpenAI-compatible endpoint on :4000 (LAN-only, no auth).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jeremy