herdr-core machine add kept failing with "core did not start within 5 s".
Cause: hc puts its core socket under XDG_RUNTIME_DIR, which on Unraid is
/run/user/0 — created and destroyed per login session by elogind. The socket
vanished with the session that started the core, so later clients found an
empty directory. The core itself kept running on an unlinked socket, and
core.log stayed empty because the failure is client side.
Fixed entirely on the Mac with a --via transport that pins
XDG_RUNTIME_DIR=/var/run/herdr-rt. Nothing on the server was changed. The
transport uses key auth on 192.168.10.20:422, not Tailscale SSH, since --via
needs something that asks nothing and the default tailnet ACL demands
periodic browser re-auth.
Also records the reboot caveat (/ is RAM, so the remote hc binary is lost)
with a go-script fix written up but not applied, and corrects the
192.168.31.0/24 note: that shim was created for a Pi-hole that AdGuard
replaced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Approved in the Tailscale admin console, so xtrm-unraid now shows as
"offers exit node" and appears in tailscale exit-node list. The tailnet has
two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback).
Neither has been exercised from the Mac. Noted that without
--exit-node-allow-lan-access an exit node cuts the client's own LAN access,
which would break an SSH session routed over Tailscale.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Unraid's Tailscale plugin node had been logged out since roughly May 2026.
Re-enrolled as xtrm-unraid (100.100.208.69); the stale 100.100.208.70 node
was deleted first, so the tailnet issued a new address.
Dropped the old 192.168.31.0/24 advertisement — that subnet is only the
macvlan shim and nothing reachable lives there. No LAN subnet routes are
advertised from Unraid; the MikroTik container stays primary. accept-routes
and accept-dns stay off, the former because Unraid sits on 192.168.10.0/24
and would otherwise loop.
Tailscale SSH enabled, since sshd binds only 192.168.10.20 and
192.168.31.250 and so never listens on the Tailscale IP. Port forwarding
over it verified.
Exit node advertised, pending approval in the admin console.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
5-view Mushroom dashboard deployed to HAOS via init_commands technique
(file-based YAML cannot be saved via lovelace/config/save WebSocket).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Compose stack at appdata/immich, exposed via Traefik at photos.xtrm-lab.org
- Library on cache NVMe (raidz1), Postgres on cache
- Nightly backup (DB dump + originals rsync) to parity-protected array disk1
- Google Takeout import ready via immich-go v0.32.0
- Document ollama migrated to Dockge stack on ollama/ollama:rocm with
gfx1103 enablement (HSA_OVERRIDE_GFX_VERSION=11.0.0, OLLAMA_IGPU_ENABLE=1)
- Verified Ornith 1.0 9B runs 100% on the 780M iGPU (~11 tok/s)
- CHANGELOG entry for 2026-06-29
- (also includes previously-uncommitted Development services section
already present in the working tree)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fixed Transport endpoint not connected error — Plex volume mount
needed :rslave propagation to see rclone FUSE mount from zurg.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Document Kasm DinD architecture, Traefik integration, and the
proxy_port/frameDeny fixes that resolved session connection failures.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Installed Cooperator CLI, glab, uv+Python 3.12, 6 custom skills,
and built MCP servers (shortcut, mikrotik, unraid). MCP registration
via `claude mcp add` still pending as TODO.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable bridge VLAN filtering on CAP for proper per-client VLAN assignment
- Fix AdGuard container IP conflicts (.2→.10, .3→.11) with static IPs
- Fix 2.4GHz co-channel interference (both APs were on ch 1, CAP now ch 6)
- Fix 5GHz overlap (HAP ch 36/5180, CAP moved to ch 52/5260)
- Update WiFi access-list: VLAN assignment now active with per-device VLAN IDs
- Add Xiaomi Air Purifier MC1 to VLAN 30 access-list
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New motherboard installed, MAC/DHCP updated
- 3x Samsung 990 EVO Plus 1TB NVMe cache pool (ZFS RAIDZ1)
- Docker migrated from HDD loopback to NVMe ZFS storage driver
- disk1 confirmed dead (clicking heads), still on parity emulation
- Hardware inventory, changelog, and incident report updated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- 07-WIFI-CAPSMAN: CAP both radios working, access list no VLAN assignment
- 01-NETWORK-MAP: fix CAP IP .6→.2, add Nobara and SMB shares section
- 04-HARDWARE-INVENTORY: CAP SSH/version details, add Recalbox device
- 06-VLAN-DEVICE-ASSIGNMENT: add Nobara (VLAN 10), Recalbox (VLAN 25)
- 03-SERVICES-OTHER: add Roms SMB share section with mount details
- CHANGELOG: add 2026-02-14 entries
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deployed automatic failover for critical services (Traefik, Vaultwarden,
Authentik, AdGuard) from Unraid to Nobara workstation via Keepalived VRRP
with VIP 192.168.10.250. ~4 second failover time.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
