From 2948d88a5d8c506e302417f99bf8b72b5fba02b2 Mon Sep 17 00:00:00 2001 From: J1 Pipeline Date: Thu, 9 Jul 2026 15:13:00 +0000 Subject: [PATCH] =?UTF-8?q?chore(scrub):=20Phase=205=20sanitization=20?= =?UTF-8?q?=E2=80=94=20generalize=20private-infra=20refs=20(vendor-agnosti?= =?UTF-8?q?c)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .env.example | 6 +++--- .github/workflows/ci-cd.yml | 2 +- CODE_OF_CONDUCT.md | 2 +- README.md | 22 +++++++++++----------- SECURITY.md | 2 +- docs/HERMES_SETUP.md | 2 +- docs/MAINTENANCE.md | 2 +- docs/SERVER_SETUP.md | 6 +++--- docs/hermes.md | 6 +++--- gateway/server.py | 6 +++--- gateway/tests/test_gateway.py | 6 +++--- test_results.txt | 4 ++-- tests/smoke.sh | 4 ++-- 13 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.env.example b/.env.example index a7638b8..74d6a51 100644 --- a/.env.example +++ b/.env.example @@ -1,9 +1,9 @@ # StackDeploy — server config -# Tailscale IP of this server -SERVER_IP=REPLACE_WITH_YOUR_TAILSCALE_IP +# Mesh-VPN IP of this server +SERVER_IP=REPLACE_WITH_YOUR_MESH_VPN_IP # Obsidian vault path on the host -OBSIDIAN_VAULT_PATH=/home/j1admin/ObsidianVault +OBSIDIAN_VAULT_PATH=/home//ObsidianVault # Services HONCHO_TOKEN=REPLACE_WITH_YOUR_HONCHO_TOKEN diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index a9810f3..34f81f4 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -90,7 +90,7 @@ jobs: key: ${{ secrets.DEPLOY_SSH_KEY }} port: ${{ secrets.DEPLOY_PORT }} script: | - cd /home/j1admin/StackDeploy + cd /home//StackDeploy git pull origin main cp .env.example .env 2>/dev/null || true docker compose pull diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 256974a..1248314 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -35,7 +35,7 @@ Examples of unacceptable behavior: ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the project team at j1admin@onebyjorah.com. All complaints will +reported to the project team at security@jorahone.com. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. diff --git a/README.md b/README.md index 28179c2..e1715a0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # StackDeploy Dashboard -Self-hosted all-in-one API platform — deploy SearXNG, Qdrant, Honcho, Ollama, Camofox, and Obsidian behind a single gateway with auto-discoverable APIs, Tailscale mesh, and optional Cloudflare Tunnel for public HTTPS. Choose between local LLM inference (Ollama) or cloud API (OpenRouter) for Honcho's AI features. +Self-hosted all-in-one API platform — deploy SearXNG, Qdrant, Honcho, Ollama, Camofox, and Obsidian behind a single gateway with auto-discoverable APIs, Mesh-VPN mesh, and optional Cloudflare Tunnel for public HTTPS. Choose between local LLM inference (Ollama) or cloud API (OpenRouter) for Honcho's AI features. [![CI](https://github.com/OneByJorah/StackDeploy-Dashboard/actions/workflows/ci.yml/badge.svg)](https://github.com/OneByJorah/StackDeploy-Dashboard/actions/workflows/ci.yml) ![Version](https://img.shields.io/badge/version-2.0.0-FFB300?style=flat-square) @@ -35,7 +35,7 @@ Open **http://localhost:9090** for the onboarding dashboard or **http://localhos - **Interactive Setup** — `./setup.sh` prompts for passwords, generates `.env`, no manual editing - **Local LLM (Ollama)** — Run Honcho entirely offline with local model inference (opt-in via `--with-local-llm` or `--auto`) - **Cloud or Local** — Choose between local Ollama or cloud OpenRouter during setup; `.env.honcho` configured automatically -- **Tailscale Mesh** — Each service gets its own Tailscale identity for secure mesh networking +- **Mesh-VPN Mesh** — Each service gets its own Mesh-VPN identity for secure mesh networking - **Cloudflare Tunnel** — Optional public HTTPS access via Cloudflare Tunnel (no open firewall ports) - **Auto-Discovery** — Gateway aggregates health and connection info for all backend services @@ -46,7 +46,7 @@ graph TB subgraph Public A[Cloudflare Tunnel] end - subgraph Tailscale_Mesh + subgraph Mesh-VPN_Mesh B[Gateway :9090] C[SearXNG :8080] D[Qdrant :6333] @@ -89,7 +89,7 @@ StackDeploy Dashboard is the control-plane island in the JorahOne archipelago This interactive script will prompt for: 1. **Admin credentials** — username/password for the gateway dashboard -2. **Tailscale auth key** — optional, for mesh networking (get one from https://login.tailscale.com/admin/settings/keys) +2. **Mesh-VPN auth key** — optional, for mesh networking (get one from https://login.mesh-vpn.com/admin/settings/keys) 3. **Cloudflare Tunnel token** — optional, for public HTTPS access (create a tunnel at https://one.dash.cloudflare.com/) 4. **LLM Provider** — choose between: - **(L)ocal Ollama** — runs entirely on-device, no API key needed. You pick a default model (default: `llama3.2`) @@ -107,8 +107,8 @@ sudo ./bootstrap.sh --auto # With a different model sudo ./bootstrap.sh --auto --model llama3.2:1b -# With custom model + Tailscale + Cloudflare -sudo ./bootstrap.sh --auto --with-tailscale --with-public +# With custom model + Mesh-VPN + Cloudflare +sudo ./bootstrap.sh --auto --with-mesh-vpn --with-public ``` `--auto` does everything: generates a secure `.env` with random passwords, generates `.env.honcho` pointing to local Ollama, deploys all services, pulls the default model (`llama3.2:1b`), and restarts Honcho to activate it. The admin password is printed at the end. @@ -125,14 +125,14 @@ sudo ./bootstrap.sh --with-local-llm # With a specific Ollama model sudo ./bootstrap.sh --with-local-llm --model qwen2.5:0.5b -# With Tailscale mesh -sudo ./bootstrap.sh --with-tailscale +# With Mesh-VPN mesh +sudo ./bootstrap.sh --with-mesh-vpn -# With Tailscale + Cloudflare Tunnel (public HTTPS) -sudo ./bootstrap.sh --with-tailscale --with-public +# With Mesh-VPN + Cloudflare Tunnel (public HTTPS) +sudo ./bootstrap.sh --with-mesh-vpn --with-public # With everything -sudo ./bootstrap.sh --with-tailscale --with-public --with-local-llm +sudo ./bootstrap.sh --with-mesh-vpn --with-public --with-local-llm # Skip setup prompt (use existing .env) sudo ./bootstrap.sh --skip-setup diff --git a/SECURITY.md b/SECURITY.md index be4cad0..235dfdf 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,7 @@ for receiving patches depends on the CVSS v3.0 rating: ## Reporting a Vulnerability -Please report security vulnerabilities to **j1admin@onebyjorah.com**. Do NOT +Please report security vulnerabilities to **security@jorahone.com**. Do NOT report security vulnerabilities through public GitHub issues. You should receive a response within 48 hours. If for some reason you do not, diff --git a/docs/HERMES_SETUP.md b/docs/HERMES_SETUP.md index 379a02a..2f9783f 100644 --- a/docs/HERMES_SETUP.md +++ b/docs/HERMES_SETUP.md @@ -43,7 +43,7 @@ honcho: obsidian: enabled: true - vault_path: /home/j1admin/ObsidianVault + vault_path: /home//ObsidianVault ``` For local Obsidian, open the vault folder in the desktop app. Hermes reads and writes notes directly through the Obsidian skill. diff --git a/docs/MAINTENANCE.md b/docs/MAINTENANCE.md index 3dbf8de..c6ef98f 100644 --- a/docs/MAINTENANCE.md +++ b/docs/MAINTENANCE.md @@ -15,5 +15,5 @@ docker compose up -d llama-server ## Backup Honcho memory ```bash -tar czf honcho-backup.tgz /home/j1admin/docker/j1-stack-deploy/honcho +tar czf honcho-backup.tgz /home//docker/j1-stack-deploy/honcho ``` diff --git a/docs/SERVER_SETUP.md b/docs/SERVER_SETUP.md index e1618d4..c98e0a4 100644 --- a/docs/SERVER_SETUP.md +++ b/docs/SERVER_SETUP.md @@ -3,7 +3,7 @@ ## Prerequisites - Docker + Docker Compose v2+ -- Tailscale installed +- Mesh-VPN installed ## Install @@ -30,7 +30,7 @@ docker compose up -d | Variable | Purpose | Notes | |---|---|---| -| `SERVER_IP` | Tailscale or local IP used in docs/examples | Required | +| `SERVER_IP` | Mesh-VPN or local IP used in docs/examples | Required | | `HONCHO_TOKEN` | Auth token for Honcho API | Optional | | `HONCHO_DB_PASSWORD` | Postgres password for Honcho backend | Required | | `POSTGRES_PASSWORD` | Postgres password | Required | @@ -81,7 +81,7 @@ docker compose logs -f ## Troubleshooting - If services fail to start, inspect `docker compose up -d && docker compose logs -f`. -- Ensure `SERVER_IP` matches the host address used by other clients (Tailscale recommended). +- Ensure `SERVER_IP` matches the host address used by other clients (Mesh-VPN recommended). --- diff --git a/docs/hermes.md b/docs/hermes.md index 5a3eddd..8b404ee 100644 --- a/docs/hermes.md +++ b/docs/hermes.md @@ -22,16 +22,16 @@ curl -s -o /dev/null -w 'qdrant=%{http_code}\n' http://localhost:6333/ - Web UI / REST API root - Obsidian - Web UI: `http://localhost:8083` - - Vault path: `/home/j1admin/ObsidianVault` + - Vault path: `/home//ObsidianVault` ## BrowserSearch CLI ```bash -cd /home/j1admin/StackDeploy/browser-search +cd /home//StackDeploy/browser-search node scripts/cloak/cloak-fetch.mjs "https://example.com" --format markdown ``` ## Smoke test ```bash -cd /home/j1admin/StackDeploy +cd /home//StackDeploy bash tests/smoke.sh ``` diff --git a/gateway/server.py b/gateway/server.py index d2a6070..5bd5a0c 100644 --- a/gateway/server.py +++ b/gateway/server.py @@ -179,13 +179,13 @@ async def discover(credentials: Optional[str] = Depends(verify_admin_optional)): result = await check_service_health(name, svc) results.append(result) - # Tailnet info (if available) - tailscale_hostname = os.getenv("TS_CERT_DOMAIN", "") + # Mesh info (if available) + mesh-vpn_hostname = os.getenv("TS_CERT_DOMAIN", "") return { "platform": "StackDeploy Dashboard", "version": "2.0.0", - "tailnet_hostname": tailscale_hostname, + "mesh_hostname": mesh-vpn_hostname, "cloudflare_domain": os.getenv("CLOUDFLARE_TUNNEL_DOMAIN", ""), "services": results, "healthy_count": sum(1 for r in results if r["healthy"]), diff --git a/gateway/tests/test_gateway.py b/gateway/tests/test_gateway.py index d500080..e382570 100644 --- a/gateway/tests/test_gateway.py +++ b/gateway/tests/test_gateway.py @@ -157,9 +157,9 @@ def test_discover_service_details(self, mock_async_client): assert svc["description"] == SERVICE_REGISTRY[svc["name"]]["description"] @patch("server.httpx.AsyncClient") - def test_discover_includes_tailnet_hostname(self, mock_async_client): + def test_discover_includes_mesh_hostname(self, mock_async_client): """TS_CERT_DOMAIN env var should appear in discover response.""" - os.environ["TS_CERT_DOMAIN"] = "test.tailnet.com" + os.environ["TS_CERT_DOMAIN"] = "test.mesh.com" mock_async_client.return_value = mock_health_response(healthy=True) # Re-import app to pick up env var — but lazy approach: just check directly @@ -168,7 +168,7 @@ def test_discover_includes_tailnet_hostname(self, mock_async_client): c2 = TestClient(app2) response = c2.get("/api/v1/discover") data = response.json() - assert data["tailnet_hostname"] == "test.tailnet.com" + assert data["mesh_hostname"] == "test.mesh.com" @patch("server.httpx.AsyncClient") def test_discover_includes_cloudflare_domain(self, mock_async_client): diff --git a/test_results.txt b/test_results.txt index 98a2a6b..065e7b8 100644 --- a/test_results.txt +++ b/test_results.txt @@ -8,7 +8,7 @@ name: stackdeploy services: honcho-api: build: - context: /home/j1admin/StackDeploy/vendor/honcho + context: /home//StackDeploy/vendor/honcho dockerfile: docker/Dockerfile depends_on: honcho-db: @@ -41,7 +41,7 @@ services: restart: unless-stopped volumes: - type: bind - source: /home/j1admin/StackDeploy/honcho/config.toml + source: /home//StackDeploy/honcho/config.toml target: /app/config.toml read_only: true bind: {} diff --git a/tests/smoke.sh b/tests/smoke.sh index 6337fdc..e295e62 100644 --- a/tests/smoke.sh +++ b/tests/smoke.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash set -euo pipefail -cd /home/j1admin/StackDeploy +cd /home//StackDeploy echo '=== Service checks ===' curl -s -o /dev/null -w 'searxng=%{http_code}\n' 'http://localhost:8080/search?format=json&q=test' @@ -17,7 +17,7 @@ curl -s -X POST http://localhost:9377/tabs -H 'Content-Type: application/json' - python3 -c 'import json,sys; d=json.load(open("/tmp/sd_camofox_tab.json")); print("tabId=", d.get("tabId")); assert d.get("tabId"), "tabId missing"' echo '=== CloakBrowser CLI ===' -node /home/j1admin/StackDeploy/browser-search/scripts/cloak/cloak-fetch.mjs --help > /dev/null 2>&1 +node /home//StackDeploy/browser-search/scripts/cloak/cloak-fetch.mjs --help > /dev/null 2>&1 echo '=== Obsidian page ===' curl -s http://localhost:8083/ | grep -q 'Obsidian v1.7.7'