The country=United States override existed to reach UNII-3 (5745 MHz),
which is not permitted in the EU. It cost more than it gained: clients in
the BG regulatory domain were power-restricted on those channels.
Setting country=Bulgaria raised the test client from 241 to 295 Mbps
immediately and ~451 Mbps once rate adaptation settled, with client signal
improving from -72 to -67 dBm. Total gain this session: 38 -> 451 Mbps.
Also:
- cfg-xtrm security.encryption tkip -> ccmp (provisioning rule 0 would
have handed TKIP to any new 5GHz CAP interface, forcing legacy rates)
- cap-wifi1 moved to 5220 MHz (ch 44, non-DFS, legal in BG); still disabled
- Corrected: HAP wifi2 is disabled with encryption="", not tkip
- Noted that country does NOT hard-block an illegal frequency
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Channel 149 (UNII-3) is not permitted in Bulgaria/EU. The radio reached it
via country=United States, but BG-domain clients were power-restricted
there, giving a badly asymmetric link and ~38 Mbps at the desk.
Moving to 5180 MHz (ch 36), legal in BG and non-DFS, raised the same
client to ~241 Mbps.
Also corrected:
- CAP capdp datapath is vlan-id=30, not 40
- RouterOS versions: hAP, cAP XL and cAP AC are all on 7.23.3
- Added WAN baseline: ~880 Mbps down / ~720 Mbps up on a 1 Gbps ONT link
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Audit 2026-08-07 found dns-failover-down NAT script pointed DNS traffic
at 192.168.10.10:3000 (AdGuard web UI) instead of :53 (DNS resolver).
On real failover this would have broken DNS network-wide. Fixed live on
MikroTik and verified with controlled failover test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5-view Mushroom dashboard deployed to HAOS via init_commands technique
(file-based YAML cannot be saved via lovelace/config/save WebSocket).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Compose stack at appdata/immich, exposed via Traefik at photos.xtrm-lab.org
- Library on cache NVMe (raidz1), Postgres on cache
- Nightly backup (DB dump + originals rsync) to parity-protected array disk1
- Google Takeout import ready via immich-go v0.32.0
The flash-attention + q8_0 KV cache settings were removed after they (and the
gfx1103 ROCm path generally) crash on large prompts. Document that the 780M iGPU
is direct/interactive-chat only, not an agent backend (Hermes ~15.5k-token prompt
crashed every call; reverted to cloud model).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Document ollama migrated to Dockge stack on ollama/ollama:rocm with
gfx1103 enablement (HSA_OVERRIDE_GFX_VERSION=11.0.0, OLLAMA_IGPU_ENABLE=1)
- Verified Ornith 1.0 9B runs 100% on the 780M iGPU (~11 tok/s)
- CHANGELOG entry for 2026-06-29
- (also includes previously-uncommitted Development services section
already present in the working tree)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Replace v1 AUTOKUMA_DOCKER=1 with v2 env vars (ENABLED, HOSTS, SOURCE)
- Rewrite traefik-manager labels in v2 4-part syntax: kuma.<id>.<type>.<setting>
- Delete manually-created monitor #38; AutoKuma recreates it (now #39) cleanly
- Document v2 label requirements and the remaining v1-label migration
Default AUTOKUMA__DOCKER__SOURCE is Swarm Services — must be set to
Containers for standalone Docker. v2 also doesn't accept the v1 shorthand
(kuma=URL + kuma.name=... + kuma.type=...), only the explicit 4-part form.
- Pinned traefik-manager to 172.18.0.4 (was floating in the dynamic pool)
- Added Uptime Kuma monitor id=38 "Traefik Container (direct)" — TCP probe
at 172.18.0.3:80, decoupled from the routing-layer HTTP probe so a
Traefik container failure is distinguishable from a routing breakage
- Documented that AutoKuma v2 is silently broken; monitor was created via
direct SQL insert as a workaround
Recreated dockerproxy network with --ip-range 172.18.0.128/25 so Docker
auto-allocations are isolated from the .2-.127 static reservation block.
Eliminates IP-collision class that caused the 2026-05-17 Traefik outage.
Adds 13-DOCKERPROXY-NETWORK.md as the canonical reference for the
network spec, recreate command, and current IP assignments.
Fixed Transport endpoint not connected error — Plex volume mount
needed :rslave propagation to see rclone FUSE mount from zurg.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Document Kasm DinD architecture, Traefik integration, and the
proxy_port/frameDeny fixes that resolved session connection failures.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
cAP XL ac cannot support traffic-processing=on-capsman (Qualcomm driver
limitation). Updated CAP device info, VLAN assignment notes, and added
troubleshooting entry for "could not assign vlan" errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Installed Cooperator CLI, glab, uv+Python 3.12, 6 custom skills,
and built MCP servers (shortcut, mikrotik, unraid). MCP registration
via `claude mcp add` still pending as TODO.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable bridge VLAN filtering on CAP for proper per-client VLAN assignment
- Fix AdGuard container IP conflicts (.2→.10, .3→.11) with static IPs
- Fix 2.4GHz co-channel interference (both APs were on ch 1, CAP now ch 6)
- Fix 5GHz overlap (HAP ch 36/5180, CAP moved to ch 52/5260)
- Update WiFi access-list: VLAN assignment now active with per-device VLAN IDs
- Add Xiaomi Air Purifier MC1 to VLAN 30 access-list
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
