kyle
ad7e5b6f42
docs: proposed tagged tailnet ACL (Phase 2 draft, review only)
...
server/cloud/mobile/iot tags, funnel scoped to servers+cloud, mobile
limited to HA/Mattermost/Syncthing/DSM, pre-allowed agent+metrics flows,
policy tests included.
2026-11-01 14:51:10 -08:00
kyle
01018fcbda
docs: fleet security plan v1.3 + tailnet ACL baseline
...
Phase 0 findings: password auth confirmed on (straylight, dixie), ACL
default allow-all, funnel-for-all, titan stale public funnel, gitea
public edge on nginx 1.18.0. Plan: 6 pillars, 6 phases, decisions and
assumptions register inline.
2026-11-01 13:35:35 -08:00
kyle and Claude Opus 5.5
c12b2adbfd
disk-health plan: deploy via committed master + doas (per CLAUDE.md)
...
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com >
2026-09-24 18:59:39 -07:00
kyle and Claude Opus 5.5
85d5631fa8
docs: disk-health monitoring plan (SMART/NVMe/SD card)
...
Current state verified on 2026-09-24: hyperborea NVMe already exported
via the Debian nvme textfile; no SMART on the NixOS hosts; no
disk-health alert rules. Plan: smartctl_exporter module for the NixOS
hosts, smartmon timer and SD-card kernel-error textfile on hyperborea,
orion scrape job, a disk-health rule group, verification and deploy
notes. For hand-off to another agent.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com >
2026-09-24 18:59:15 -07:00
kyle
c07c4bfe4f
docs: fix tether cancel-storm PromQL (rule 2)
...
Label-set mismatch made the ratio empty. Select reason=client_disconnect
and kind=converted; never sum() a tether series without a selector.
2026-09-23 22:50:26 -07:00
kyle
8b14e1f99f
docs: fleet metrics and alerting plan
...
Reviewed plan only: VictoriaMetrics on orion, vmalert/Alertmanager,
tailnet exporters, first five rules. No config, no deploy.
2026-09-23 22:48:51 -07:00
kyle
