Sanitized mirror from private repository - 2026-04-18 11:19:59 UTC

2026-04-18 11:19:59 +00:00
commit fb00a325d1
1418 changed files with 359990 additions and 0 deletions
--- a/hosts/physical/concord-nuc/README.md
+++ b/hosts/physical/concord-nuc/README.md
@@ -0,0 +1,145 @@
+# Concord NUC
+
+**Hostname**: concord-nuc / vish-concord-nuc
+**IP Address**: 192.168.68.100 (static, eno1)
+**Tailscale IP**: 100.72.55.21
+**OS**: Ubuntu (cloud-init based)
+**SSH**: `ssh vish-concord-nuc` (via Tailscale — see `~/.ssh/config`)
+
+---
+
+## Network Configuration
+
+### Static IP Setup
+
+`eno1` is configured with a **static IP** (`192.168.68.100/22`) via netplan. This is required because AdGuard Home binds its DNS listener to a specific IP, and DHCP lease changes would cause it to crash.
+
+**Netplan config**: `/etc/netplan/50-cloud-init.yaml`
+
+```yaml
+network:
+    ethernets:
+        eno1:
+            dhcp4: false
+            addresses:
+                - 192.168.68.100/22
+            routes:
+                - to: default
+                  via: 192.168.68.1
+            nameservers:
+                addresses:
+                    - 9.9.9.9
+                    - 1.1.1.1
+    version: 2
+    wifis:
+        wlp1s0:
+            access-points:
+                This_Wifi_Sucks:
+                    password: "REDACTED_PASSWORD"
+            dhcp4: true
+```
+
+**Cloud-init is disabled** from managing network config:
+`/etc/cloud/cloud.cfg.d/99-disable-network-config.cfg` — prevents reboots from reverting to DHCP.
+
+> **Warning**: If you ever re-enable cloud-init networking or wipe this file, eno1 will revert to DHCP and AdGuard will start crash-looping on the next restart. See the Troubleshooting section below.
+
+---
+
+## Services
+
+| Service | Port | URL |
+|---------|------|-----|
+| AdGuard Home (Web UI) | 9080 | http://192.168.68.100:9080 |
+| AdGuard Home (DNS) | 53 | 192.168.68.100:53, 100.72.55.21:53 |
+| Home Assistant | - | see homeassistant.yaml |
+| Plex | - | see plex.yaml |
+| Syncthing | - | see syncthing.yaml |
+| Invidious | 3000 | https://in.vish.gg (public), http://192.168.68.100:3000 |
+| Materialious | 3001 | http://192.168.68.100:3001 |
+| YourSpotify | 4000, 15000 | see yourspotify.yaml |
+
+---
+
+## Deployed Stacks
+
+| Compose File | Service | Notes |
+|-------------|---------|-------|
+| `adguard.yaml` | AdGuard Home | DNS ad blocker, binds to 192.168.68.100 |
+| `homeassistant.yaml` | Home Assistant | Home automation |
+| `plex.yaml` | Plex | Media server |
+| `syncthing.yaml` | Syncthing | File sync |
+| `wireguard.yaml` | WireGuard / wg-easy | VPN |
+| `dyndns_updater.yaml` | DynDNS | Dynamic DNS |
+| `node-exporter.yaml` | Node Exporter | Prometheus metrics |
+| `piped.yaml` | Piped | YouTube alternative frontend |
+| `yourspotify.yaml` | YourSpotify | Spotify stats |
+| `invidious/invidious.yaml` | Invidious + Companion + DB + Materialious | YouTube frontend — https://in.vish.gg |
+
+---
+
+## Troubleshooting
+
+### AdGuard crash-loops on startup
+
+**Symptom**: `docker ps` shows AdGuard as "Restarting" or "Up Less than a second"
+
+**Cause**: AdGuard binds DNS to a specific IP (`192.168.68.100`). If the host's IP changes (DHCP), or if AdGuard rewrites its config to the current DHCP address, it will fail to bind on next start.
+
+**Diagnose**:
+```bash
+docker logs AdGuard --tail 20
+# Look for: "bind: cannot assign requested address"
+# The log will show which IP it tried to use
+```
+
+**Fix**:
+```bash
+# 1. Check what IP AdGuard thinks it should use
+sudo grep -A3 'bind_hosts' /home/vish/docker/adguard/config/AdGuardHome.yaml
+
+# 2. Check what IP eno1 actually has
+ip addr show eno1 | grep 'inet '
+
+# 3. If they don't match, update the config
+sudo sed -i 's/- 192.168.68.XXX/- 192.168.68.100/' /home/vish/docker/adguard/config/AdGuardHome.yaml
+
+# 4. Restart AdGuard
+docker restart AdGuard
+```
+
+**If the host IP has reverted to DHCP** (e.g. after a reboot wiped the static config):
+```bash
+# Re-apply static IP
+sudo netplan apply
+
+# Verify
+ip addr show eno1 | grep 'inet '
+# Should show: inet 192.168.68.100/22
+```
+
+---
+
+## Incident History
+
+### 2026-02-22 — AdGuard crash-loop / IP mismatch
+
+- **Root cause**: Host had drifted from `192.168.68.100` to DHCP-assigned `192.168.68.87`. AdGuard briefly started, rewrote its config to `.87`, then the static IP was applied and `.87` was gone — causing a bind failure loop.
+- **Resolution**:
+  1. Disabled cloud-init network management
+  2. Set `eno1` to static `192.168.68.100/22` via netplan
+  3. Corrected `AdGuardHome.yaml` `bind_hosts` back to `.100`
+  4. Restarted AdGuard — stable
+
+---
+
+### 2026-02-27 — Invidious 502 / crash-loop
+
+- **Root cause 1**: PostgreSQL 14 defaults `pg_hba.conf` to `scram-sha-256` for host connections. Invidious's Crystal DB driver does not support scram-sha-256, causing a "password authentication failed" crash loop even with correct credentials.
+  - **Fix**: Changed last line of `/var/lib/postgresql/data/pg_hba.conf` in the `invidious-db` container from `host all all all scram-sha-256` to `host all all 172.21.0.0/16 trust`, then ran `SELECT pg_reload_conf();`.
+- **Root cause 2**: Portainer had saved the literal string `REDACTED_SECRET_KEY` as the `SERVER_SECRET_KEY` env var for the companion container (Portainer's secret-redaction placeholder was baked in as the real value). The latest companion image validates the key strictly (exactly 16 alphanumeric chars), causing it to crash.
+  - **Fix**: Updated the Portainer stack file via API (`PUT /api/stacks/584`), replacing all `REDACTED_*` placeholders with the real values.
+
+---
+
+*Last updated: 2026-02-27*