herdr-core machine add kept failing with "core did not start within 5 s".
Cause: hc puts its core socket under XDG_RUNTIME_DIR, which on Unraid is
/run/user/0 — created and destroyed per login session by elogind. The socket
vanished with the session that started the core, so later clients found an
empty directory. The core itself kept running on an unlinked socket, and
core.log stayed empty because the failure is client side.
Fixed entirely on the Mac with a --via transport that pins
XDG_RUNTIME_DIR=/var/run/herdr-rt. Nothing on the server was changed. The
transport uses key auth on 192.168.10.20:422, not Tailscale SSH, since --via
needs something that asks nothing and the default tailnet ACL demands
periodic browser re-auth.
Also records the reboot caveat (/ is RAM, so the remote hc binary is lost)
with a go-script fix written up but not applied, and corrects the
192.168.31.0/24 note: that shim was created for a Pi-hole that AdGuard
replaced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Approved in the Tailscale admin console, so xtrm-unraid now shows as
"offers exit node" and appears in tailscale exit-node list. The tailnet has
two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback).
Neither has been exercised from the Mac. Noted that without
--exit-node-allow-lan-access an exit node cuts the client's own LAN access,
which would break an SSH session routed over Tailscale.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Unraid's Tailscale plugin node had been logged out since roughly May 2026.
Re-enrolled as xtrm-unraid (100.100.208.69); the stale 100.100.208.70 node
was deleted first, so the tailnet issued a new address.
Dropped the old 192.168.31.0/24 advertisement — that subnet is only the
macvlan shim and nothing reachable lives there. No LAN subnet routes are
advertised from Unraid; the MikroTik container stays primary. accept-routes
and accept-dns stay off, the former because Unraid sits on 192.168.10.0/24
and would otherwise loop.
Tailscale SSH enabled, since sshd binds only 192.168.10.20 and
192.168.31.250 and so never listens on the Tailscale IP. Port forwarding
over it verified.
Exit node advertised, pending approval in the admin console.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Xiaomi miIO/MIoT devices silently ignore UDP packets from source IPs
outside their subnet. Added SRCNAT masquerade rule documentation for
VLAN 10 → VLAN 30 on UDP 54321, enabling HA local control of air
purifiers and other Xiaomi WiFi devices.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Audit 2026-08-07 found dns-failover-down NAT script pointed DNS traffic
at 192.168.10.10:3000 (AdGuard web UI) instead of :53 (DNS resolver).
On real failover this would have broken DNS network-wide. Fixed live on
MikroTik and verified with controlled failover test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5-view Mushroom dashboard deployed to HAOS via init_commands technique
(file-based YAML cannot be saved via lovelace/config/save WebSocket).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The flash-attention + q8_0 KV cache settings were removed after they (and the
gfx1103 ROCm path generally) crash on large prompts. Document that the 780M iGPU
is direct/interactive-chat only, not an agent backend (Hermes ~15.5k-token prompt
crashed every call; reverted to cloud model).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Document ollama migrated to Dockge stack on ollama/ollama:rocm with
gfx1103 enablement (HSA_OVERRIDE_GFX_VERSION=11.0.0, OLLAMA_IGPU_ENABLE=1)
- Verified Ornith 1.0 9B runs 100% on the 780M iGPU (~11 tok/s)
- CHANGELOG entry for 2026-06-29
- (also includes previously-uncommitted Development services section
already present in the working tree)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cAP XL ac cannot support traffic-processing=on-capsman (Qualcomm driver
limitation). Updated CAP device info, VLAN assignment notes, and added
troubleshooting entry for "could not assign vlan" errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Installed Cooperator CLI, glab, uv+Python 3.12, 6 custom skills,
and built MCP servers (shortcut, mikrotik, unraid). MCP registration
via `claude mcp add` still pending as TODO.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable bridge VLAN filtering on CAP for proper per-client VLAN assignment
- Fix AdGuard container IP conflicts (.2→.10, .3→.11) with static IPs
- Fix 2.4GHz co-channel interference (both APs were on ch 1, CAP now ch 6)
- Fix 5GHz overlap (HAP ch 36/5180, CAP moved to ch 52/5260)
- Update WiFi access-list: VLAN assignment now active with per-device VLAN IDs
- Add Xiaomi Air Purifier MC1 to VLAN 30 access-list
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New motherboard installed, MAC/DHCP updated
- 3x Samsung 990 EVO Plus 1TB NVMe cache pool (ZFS RAIDZ1)
- Docker migrated from HDD loopback to NVMe ZFS storage driver
- disk1 confirmed dead (clicking heads), still on parity emulation
- Hardware inventory, changelog, and incident report updated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HGST Ultrastar 10TB drive (serial 2TKK3K1D) failed on Feb 18.
Array running degraded on parity emulation. Recovery plan documented.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- 07-WIFI-CAPSMAN: CAP both radios working, access list no VLAN assignment
- 01-NETWORK-MAP: fix CAP IP .6→.2, add Nobara and SMB shares section
- 04-HARDWARE-INVENTORY: CAP SSH/version details, add Recalbox device
- 06-VLAN-DEVICE-ASSIGNMENT: add Nobara (VLAN 10), Recalbox (VLAN 25)
- 03-SERVICES-OTHER: add Roms SMB share section with mount details
- CHANGELOG: add 2026-02-14 entries
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New doc: 11-CROSS-VLAN-CASTING.md with full MikroTik config
(firewall rules, FastTrack exclusion, mDNS, IGMP proxy,
AirPlay/Chromecast troubleshooting)
- Update device IPs: LG TV .40/.41, Chromecast .42
- Move HP printer from VLAN 40 to VLAN 30 at .30
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deployed automatic failover for critical services (Traefik, Vaultwarden,
Authentik, AdGuard) from Unraid to Nobara workstation via Keepalived VRRP
with VIP 192.168.10.250. ~4 second failover time.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Syncs the Vaultwarden database, RSA key, and config from Unraid
to the MikroTik container standby instance via a temporary PHP
HTTP server. Designed for manual daily runs before maintenance.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Oven (HRG7784B1) and Washing Machine (WGB24400BY) added via OAuth2.
Both dashboards updated with Bosch appliance sections.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Covers HAOS VM setup, Xiaomi/Gree/Tuya integrations, visionOS theme,
Mushroom Cards dashboards (mobile + desktop), and known issues.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Flash drive on XTRM-U is failing. Created incident doc with complete
step-by-step procedure: backup retrieval (4 options), new USB prep via
Flash Creator, license transfer via Tools→Registration, post-migration
verification checklist, and prevention measures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Major documentation cleanup after VLAN migration completion:
- Archive 12 VLAN project docs to archive/vlan-migration/
- Archive 5 done WIP docs (VLAN proposals, AI stack, Fossorial, DNS backup)
- Create standing reference docs 08-DNS-ARCHITECTURE and 09-TAILSCALE-VPN
- Renumber docs to clean 01-09 sequence with merged CHANGELOG
- Update all active docs from stale 192.168.31.x to current VLAN 10 IPs
- Fix CSS1 (.10.9→.10.3) and ZX1 (.10.7→.10.4) IPs in hardware inventory
- Clean 06-VLAN-DEVICE-ASSIGNMENT: remove migration columns/sections, fix VLAN 25 subnet
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove Portainer, add Dockge on port 5001
- Add project-specific CLAUDE.md with infrastructure instructions
- Update services documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fixed XTRM2 WiFi by enabling WPA-PSK + WPA2-PSK and setting
fixed channel 2412 MHz (channel 1) with 20MHz width.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Configured VLANs 10, 20, 25, 30 on CSS326 via SwOS API
- Added port labels: HAP-Trunk, KVM-V10, Kids-B1/B2/G1, Main-M1/M2/M3, LR-L1/L2/L3, ZX1-10G
- Updated port assignments table with detailed per-port configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- USB Hub: 34:0A:33:2C:1E:28
- MacBook Pro WiFi 5GHz: BE:A7:95:87:19:4A
- MacBook Pro WiFi 2.4GHz: CE:B8:11:EA:8D:55
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- 38:1F:8D:04:6F:E4 is the Tuya Smart Gateway, not Xiaomi
- New IP: 192.168.30.5
- Requires WPA+TKIP for connectivity
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- VLAN 20 (Trusted): Kaloyan's devices only (S25, MacBook, Gaming PC, USB Hub)
- VLAN 25 (Family): All other family members (Nora, Dancho, Kimi, Compusbg)
- Dell Monitor LAN moved to VLAN 10 (connected to HAP ether5)
- Added TBD section for USB Hub and Gaming PC WiFi MACs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Renamed MacBook Pro LAN to Dell Monitor LAN
- Assigned to VLAN 10 (Management) with IP 192.168.20.100
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Includes columns for new VLAN and new IP planning:
- 36 devices across 7 VLANs
- Organized by VLAN section and flat list views
- Ready for migration planning
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Created docs/19-WIFI-CAPSMAN-CONFIG.md documenting working WiFi settings
- Fixed 38:1F:8D:04:6F:E4 OUI - was incorrectly labeled as Tuya, is actually Xiaomi
- XTRM2 (2.4GHz) requires WPA+WPA2 with TKIP for legacy device compatibility
- CAPsMAN working with CAP XL ac on 2.4GHz
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Documents the Tailscale container setup on MikroTik hAP ax³:
- Userspace networking mode (TS_USERSPACE=true) required for RouterOS containers
- Container network configuration (172.17.0.0/24)
- NAT masquerade for internet access
- Environment variables and mount configuration
- Troubleshooting guide for common issues
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- docs/16-ADGUARD-VLAN-PLAN.md: Implementation plan for AdGuard on VLANs
- docs/17-DNS-ADGUARD-FAILOVER.md: Complete DNS architecture with:
- Dual AdGuard setup (MikroTik primary, Unraid secondary)
- Automatic failover via Netwatch monitoring
- NAT redirect rules for all VLANs
- Sync configuration between instances
- docs/wip/CONSOLE-PORT-ETHER5.md: WIP plan for dedicated console port
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Updated NAT port forwards to use 192.168.10.20 (Unraid on VLAN 10)
- Added hairpin NAT rules for internal access to WAN IP
- Updated SSH connection commands
- AdGuard DNS rules pending (not configured yet)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
