kuma-maintenance.py (open/list/delete, single-strategy windows,
version-tolerant addMaintenance probing) + pve-snapshot.sh rollback
opens a 30m window before touching a VM when ~/.creds/uptime-kuma.env
exists. TZ pinned America/Chicago. Verified: open->list(active=True)->
delete live on the fleet Kuma.
https://projects.knownelement.com/issues/769#note-4152
Completes dba54b2 (which staged deletions only — pathspec'd add missed
the content edits). Layout table, Key Scripts, DNS discipline, conman
section now point at KNEL/netinfra|facilities|perf|monitoring|inventory;
conman example switched from IP literal to pfv-tsys4 (DNS-names rule).
https://projects.knownelement.com/issues/769#note-4152
create/list/rollback/clean with cm-<ticket>-<label>-<ts> naming,
protected-VM regex (pfv-bms/netinfra/PMG/PBS), Kuma-window gate on
rollback, retention cleaner, local audit log. Verified end-to-end on
tsys5 against throwaway VM 59999 (created, rolled back, destroyed).
https://projects.knownelement.com/issues/769#note-4152
siem->KNEL/siem, netinfra->KNEL/netinfra, ca->KNEL/ca, oam->KNEL/monitoring,
cmdb->KNEL/inventory, dcinfra->KNEL/facilities, proxmox/perf->KNEL/perf;
unit tests moved with their code. AGENTS.md layout/paths repointed.
Full history retained here. Map: Redmine #769, Discourse t/331.
https://projects.knownelement.com/issues/769#note-4152
4 subdomain vhosts proxying to local docker ports; SAN cert from fleet
CA; workstation chain-verified (ssl_verify=0 all four).
Detail: https://projects.knownelement.com/issues/697
A + auto-PTR via dns-cli on primary; zone-snapshot + drift-check ALL
IN SYNC same session. Serves the fleet-TLS pass for the tsys-librenms
docker UIs.
Detail: https://projects.knownelement.com/issues/697
kuma-inventory.py printed the junk url field (https://) instead of the
hostname for ping monitors — hid ~100 monitors from FQDN matching.
kuma-add-ping.py: idempotent ping-monitor adds (exists-check by name and
target). Matrix published to Discourse t/309 (canonical, #343).
Detail: https://projects.knownelement.com/issues/343
#307 s6 rewritten post-verification: zone was ALREADY clean (zero DNS
deletes); 12 stale CIs purged from GLPI, 3 alive off-cluster systems
given proper CIs (tsys-cloudron, ultix-field/highside), 75-row seed
regenerated. software-catalog.sh: 21 products + 59 installs (wazuh
agents linked from live manager); version lookup fixed to client-side
parent filter (GLPI ignores softwares_id search param).
Detail: https://projects.knownelement.com/issues/705
dist/wazuh-agent/4.14.7-1/ (amd64+arm64+armhf) + SHA256SUMS, autoindex
enabled, workstation hash-verified against published manifest.
deploy-agent.sh now installs from the mirror (upstream fallback) and
auto-detects arch. #335: kali-tsys enrolled+active (30 total agents).
Detail: https://projects.knownelement.com/issues/758
#307 row annotated RETIRED (VM 500 gone from every node, not in the k8s
roster); seed regenerated via the converter. Also carries the ultix-offstage
retirement.
kuma-notifications.py (list/delete/usage). Deleted unused Pushover provider
'KNEL Alerts' per Charles — 211/211 monitors already on the ultix-sidecar +
Ultix-mini app webhooks. fleet-sync creation payload updated to the live
notification IDs.
to-glpi.sh: initSession, creates scoped local 'cmdb' user (Technician @
root entity, random token -> ~/.creds/glpi-agent.env), then batch-imports
systems.csv as Computers (chunked, idempotent by name, --dry-run).
Fires the moment Charles drops the corrected GLPI_USER_TOKEN.
Pure bash/jq per house rules.
deploy-agent.sh now self-heals the three postinst failure modes found on
PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root
ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with
in-file rollback notes. Rollout state in #335/#748.
Meat: https://projects.knownelement.com/issues/335#note-4008
Node retired and replaced by ultix-streaming; tailnet-side entry still
requires admin-console removal (no TS API key in store). Zone snapshot
refreshed same-session per DNS sync rule.
Ticket: https://projects.knownelement.com/issues/737
Clickable-refs mandate from Charles: ticket comments link commits,
commit bodies link the Redmine comment URL, Discourse links both —
one click between Redmine/Gitea/Discourse (GLPI/CMDB change control
will extend this). Mechanical body-URL check queued under #441.
scripts/mastodon/post.sh: zero-install curl poster; creds land in
~/.creds/mastodon.env (MASTODON_URL/MASTODON_TOKEN, write scope).
Hosts opt in via /etc/snmp/lmsensors-zone-types (one zone type per
line, e.g. Jetson GPU-therm); each type renders its own zone-<type>
chip block so HA templates anchor on the chip name. Default behavior
unchanged; no snmpd restarts (extend re-execs per poll).
Idempotent in-guest tuning: sysctl profile, fq/bbr, THP->madvise with
boot persistence (yields to tuned), fstrim.timer. First applied to
pfv-k8s-wnode-tsys3.
Ticket: https://projects.knownelement.com/issues/737
Founder rule: every Technitium/DNS/DHCP change ends with a same-session
SoR sync — zone-snapshot.sh then drift-check green, then commit. Added
the tool (tar-pulls the DZ store from the primary via the chokepoint),
wrote the rule into AGENTS.md (DNS change discipline + Key Scripts rows),
refreshed 4 stale snapshots (knel.net, 1/3.168.192 reverse, 119.70.100
— incl. the deleted ultix-offstage PTR). drift-check: ALL IN SYNC.
Also: last tsrouter mentions retired (AGENTS.md, setup.sh header).
Founder ruling 2026-09-02: ultix-offstage is retired. Removed the host
block (bc:24:11:1f:9d:83 -> 192.168.3.79) from both SoR confs and deployed
to the live pair serially with health gates; failover reports both-normal.
A record + PTR deleted from Technitium both nodes; #307 inventory rows
annotated. Tailscale device removal is a founder console action.
Founder ruling 2026-09-02: tailscale-router retired, subnet routing now
pfv-netinfra-01/02 (both advertise 192.168.0.0/22 + exit routes, verified).
Drop dead tsrouter alias from the chokepoint script; setup/verify now use
the primary as production source; refresh verify record list (tsys-nsm is
also a dead name; add tsys-wazuh CNAME + tsys-siem).
archive/KNELServerBuild copies left as read-only history by design.
Leftover unstaged state from the parallel 09-02 sessions: delete
questions-v1/v2, HomeAssistant/needfromcharles.md, night-grind-plan.md
(content lives in questions-09022206.md / questions-v3.md / git history);
drop superseded UniFi API-key ask (#619 multicast fix made it moot).
Details: https://projects.knownelement.com/issues/344#note-3911
The required-files check pinned questions-v1.md, which breaks every time
the Q&A file versions up (v2 was closed out by the parallel session,
leaving nothing matching). Now glob-accepts any version. questions-v3.md
restores the file; active question channel is ~/PTKR.md per founder.
Detail: https://projects.knownelement.com/issues/441 (latest notes)
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
How to read and rename founder todo-list items via HA REST for the
Redmine [#NNN] sync-back workflow.
Detail: https://projects.knownelement.com/issues/441 (latest notes)
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Discourse is the sole documentation space; Redmine wikis stay disabled
(verified 0/62 projects). Also repointed the stale redmine/discourse CLI
AGENTS.md references to ukrrs/connectors/KNEL-AIMiddleware.
Detail: https://projects.knownelement.com/issues/441 (latest note)
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
ntp.conf captured (nodes byte-identical); 171 Technitium DZ zone files
captured from the primary; drift-check now covers dhcpd/pihole/ntp on
both nodes plus a zones md5-manifest check. Live run caught real drift:
node-02 dhcpd.conf was a stale primary copy missing the #614 minisplit
reservation — reconciled git->02 with dhcpd -t gate, serial restart,
failover "Both servers normal", all 7 checks in sync. Red-green unit
tests extended (gen_manifest, tracked-file invariants).
Results: https://projects.knownelement.com/issues/630#note-2
New "Cloudron" group (id 277); all 55 app monitors moved there
(canary-verified). Deleted IP-literal monitor id=8 (dup of DNS-named
id=210) and repointed appletv monitor to new DNS name
stl-appletv-livingroom.knel.net. Fleet-wide IP literals in Kuma: 0.
Sync tool default group updated to 277.
Results: https://projects.knownelement.com/issues/435#note-5
55 http monitors added under "Cloud Systems" (blue/green: canary first,
verified green); 9 root-level strays re-homed into founder's groups
(root now zero). New tools: inventory (read-only dump), cloudron-sync
(idempotent diff/add from committed app list), regroup (lib-based moves;
raw editMonitor times out on this build). fleet-sync now requires
--group-id so it can never place monitors at root again.
Results: https://projects.knownelement.com/issues/435#note-4
- cnodes 102/705/603 moved to TS5-SSD storage by founder (etcd apply 4-5s -> <1s)
- wnode-tsys5 slot retired; ultix-streaming joins in its place (5 workers)
- ultix-offstage unreachable; stays excluded until back on tailnet
[#367][#368] https://projects.knownelement.com/issues/368
Live proof: ecobee answers unicast mDNS with PTR only
(_hap._tcp.local -> "Main Floor._hap._tcp.local"), so the old
replace-on-probe wiped learned records every cycle. Merge by
(name, type) instead. CONFIG_PATH now env-overridable for tests.
Details: https://projects.knownelement.com/issues/619#note-5💘 Generated with Crush
Assisted-by: Crush:glm-5.2
mrcharles