hc connect speaks the protocol over stdin/stdout, so clients attach with
ssh <box> hc connect. That failed with "hc: command not found": the binary
installs to /root/.local/bin/herdr-core, which is neither on PATH in a
non-interactive shell nor named hc. The desktop app was unaffected since it
calls the absolute path it installed.
Symlinks both names into /usr/local/bin, restored by the go script, and
records the connection details a mobile client or app builder needs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rewrites the Herdr doc to match what was actually built. The machine now
targets root@100.100.208.69 over Tailscale SSH instead of the LAN address,
so it no longer depends on the mikrotik-tailscale subnet router.
The "core did not start within 5 s" failure was the hc core socket living
under XDG_RUNTIME_DIR = /run/user/0, which pam_elogind creates and destroys
per login session. loginctl enable-linger root keeps that directory alive, so
every client agrees on the default socket path. The earlier Mac-side env pin
fixed the CLI but broke the GUI's plain-ssh "Add a machine"; linger
supersedes it and the wrapper is kept but unused.
Also records the stale ~/.ssh/config entry that pointed unraid at the deleted
100.100.208.70 on port 422, which is what the GUI had been listing, and the
go-script block that restores both the binary and linger at boot.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Tailnet SSH policy changed from the default action:"check" to accept. The
effective policy is now a single rule covering all tailnet nodes, with no
expiry and port forwarding allowed, so the per-device ~12h grants and the
browser re-auth prompt are gone.
Verified unattended with BatchMode=yes: a plain command, a -L forward
returning HTTP 302, and the Herdr fallback leg.
Records the trade-off: check acted as a second factor, so a compromised
tailnet device now reaches root on Unraid without a further step.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Records that no extra configuration is needed for remote use: the transport
already reaches 192.168.10.20 over Tailscale via the subnet router, which is
the same path used from VLAN 20 at home.
Adds a fallback to Tailscale SSH on 100.100.208.69 for the case where the
mikrotik-tailscale container dies while Unraid stays up. The target is chosen
by a TCP probe before any ssh starts, since a failed first attempt would
consume stdin and corrupt the retry.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
/boot/config/go now restores /root/.local/bin/herdr-core from
/boot/config/herdr/herdr-core at boot, with install -m 755 since /boot is
FAT32 and carries no execute bit.
Verified without rebooting: deleted the binary, ran the go line by hand, got
it back executable and reporting hc 0.1.17, with Herdr still connected.
sh -n /boot/config/go parses cleanly. The go script was backed up to
go.bak-20261103-203916 before editing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
herdr-core machine add kept failing with "core did not start within 5 s".
Cause: hc puts its core socket under XDG_RUNTIME_DIR, which on Unraid is
/run/user/0 — created and destroyed per login session by elogind. The socket
vanished with the session that started the core, so later clients found an
empty directory. The core itself kept running on an unlinked socket, and
core.log stayed empty because the failure is client side.
Fixed entirely on the Mac with a --via transport that pins
XDG_RUNTIME_DIR=/var/run/herdr-rt. Nothing on the server was changed. The
transport uses key auth on 192.168.10.20:422, not Tailscale SSH, since --via
needs something that asks nothing and the default tailnet ACL demands
periodic browser re-auth.
Also records the reboot caveat (/ is RAM, so the remote hc binary is lost)
with a go-script fix written up but not applied, and corrects the
192.168.31.0/24 note: that shim was created for a Pi-hole that AdGuard
replaced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
