From 099db04be2e3741a70d63253f901e6fafbf17e85 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:54:30 -0400 Subject: [PATCH 01/10] fix(security): parameterize hardcoded Tailscale IP in Cloudflare config generation Replace hardcoded 100.66.142.21 with SERVER_IP env var (defaults to same value for backward compatibility) in setup-wizard.sh and apply-setup.sh. This allows users to configure their own Tailscale IP and avoids leaking private network topology in source code. --- scripts/apply-setup.sh | 13 +++++++------ scripts/setup-wizard.sh | 13 +++++++------ 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/scripts/apply-setup.sh b/scripts/apply-setup.sh index 8d49ce9..730e17b 100644 --- a/scripts/apply-setup.sh +++ b/scripts/apply-setup.sh @@ -31,6 +31,7 @@ cf_tunnel=$(python3 -c "import json; print(json.load(open('$SETUP_STATE')).get(' if [[ "$mode" == "cloudflare" || "$mode" == "all" ]]; then if [ -n "$cf_host" ] && [ -n "$cf_tunnel" ]; then + SERVER_IP="${SERVER_IP:-100.66.142.21}" mkdir -p "$(dirname "$cf_config")" cat > "$cf_config" < ~/.cloudflared/config.yml < Date: Sun, 5 Jul 2026 20:54:55 -0400 Subject: [PATCH 02/10] fix(security): parameterize hardcoded devcontainer paths in setup API Replace hardcoded /workspace, /cloudflared, and /home/j1admin/.cloudflared/ paths with env-var-based defaults (REPO_ROOT, CF_DIR, CLOUDFLARED_HOME, SERVER_IP). This makes the web setup API functional outside of devcontainer environments and avoids leaking private network topology. --- noc-dashboard/backend/app.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/noc-dashboard/backend/app.py b/noc-dashboard/backend/app.py index f2c3dfe..27078e2 100644 --- a/noc-dashboard/backend/app.py +++ b/noc-dashboard/backend/app.py @@ -235,8 +235,8 @@ async def healthz(): templates = Jinja2Templates(directory="/app/templates") - REPO_ROOT = Path("/workspace") - CF_DIR = Path("/cloudflared") + REPO_ROOT = Path(os.getenv("REPO_ROOT", "/workspace")) + CF_DIR = Path(os.getenv("CF_DIR", "/cloudflared")) COMPOSE_FILE = REPO_ROOT / "docker-compose.yml" @app.get("/setup") @@ -281,7 +281,7 @@ async def apply_setup(request: Request): (REPO_ROOT / "setup-complete.json").write_text(json.dumps(payload, indent=2)) if mode in ("cloudflare", "all") and cf_host and cf_tunnel: - cf_content = f"""tunnel: {cf_tunnel}\ncredentials-file: /home/j1admin/.cloudflared/{cf_tunnel}.json\ningress:\n - hostname: {cf_host}\n path: /honcho/*\n service: http://100.66.142.21:8000\n - hostname: {cf_host}\n path: /qdrant/*\n service: http://100.66.142.21:6333\n - hostname: {cf_host}\n path: /search/*\n service: http://100.66.142.21:8080\n - hostname: {cf_host}\n path: /obsidian/*\n service: http://100.66.142.21:8083\n - hostname: {cf_host}\n path: /costforge/*\n service: http://100.66.142.21:8090\n - hostname: {cf_host}\n path: /noc/*\n service: http://100.66.142.21:9500\n - service: http_status:404\n""" + cf_content = f"""tunnel: {cf_tunnel}\ncredentials-file: {os.getenv("CLOUDFLARED_HOME", "/home/j1admin/.cloudflared")}/{cf_tunnel}.json\ningress:\n - hostname: {cf_host}\n path: /honcho/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:8000\n - hostname: {cf_host}\n path: /qdrant/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:6333\n - hostname: {cf_host}\n path: /search/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:8080\n - hostname: {cf_host}\n path: /obsidian/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:8083\n - hostname: {cf_host}\n path: /costforge/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:8090\n - hostname: {cf_host}\n path: /noc/*\n service: http://{os.getenv("SERVER_IP", "100.66.142.21")}:9500\n - service: http_status:404\n""" CF_DIR.mkdir(parents=True, exist_ok=True) (CF_DIR / "config.yml").write_text(cf_content) From 5eb60f403f0208a2ebf2ca7193def1af836d8cdd Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:55:23 -0400 Subject: [PATCH 03/10] fix(docs): align README CI/CD section with actual workflows, fix Dependabot pip directory, fix smoke test paths, fix MAINTENANCE.md - README: Replace reference to non-existent ci-cd.yml with actual codeql.yml - README: Comment out non-existent screenshot references - Dependabot: Fix pip directory from '/' to '/noc-dashboard/backend' - Smoke test: Replace hardcoded /home/j1admin/StackDeploy with script-relative paths - MAINTENANCE.md: Replace llama-server reference with docker compose pull --- .github/dependabot.yml | 2 +- README.md | 20 ++++++++------------ docs/MAINTENANCE.md | 5 +++-- tests/smoke.sh | 5 +++-- 4 files changed, 15 insertions(+), 17 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4f46c24..5b24dc6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,7 @@ version: 2 updates: - package-ecosystem: "pip" - directory: "/" + directory: "/noc-dashboard/backend" schedule: interval: "weekly" open-pull-requests-limit: 10 diff --git a/README.md b/README.md index 4c45a66..2755266 100644 --- a/README.md +++ b/README.md @@ -291,20 +291,12 @@ docker compose \ ## CI/CD & Deployment -**GitHub Actions** (`.github/workflows/ci-cd.yml`): - -```yaml -# Triggers: push to main, PR to main -# Jobs: -# 1. lint - hadolint, shellcheck, yamllint -# 2. build - docker compose build (all services) -# 3. test - spin up stack, run healthcheck.sh -# 4. deploy - SSH to server, pull, restart (on main) -``` +**GitHub Actions** (`.github/workflows/codeql.yml`): -**Branch model:** `main` = stable; feature branches for WIP. +- Weekly CodeQL security scanning (Python, JavaScript) +- Triggers: push to main/master, PR to main/master -**Deploy:** `git push origin main` → auto-deploys to configured host via SSH. +**Branch model:** `main` = stable; feature branches for WIP. --- @@ -356,6 +348,9 @@ StackDeploy/ ## Screenshots +Screenshots are planned but not yet captured. See the live deployment for visual reference. + + --- diff --git a/docs/MAINTENANCE.md b/docs/MAINTENANCE.md index 3dbf8de..3430d8e 100644 --- a/docs/MAINTENANCE.md +++ b/docs/MAINTENANCE.md @@ -6,10 +6,11 @@ docker compose restart ``` -## Update model +## Update images ```bash -docker compose up -d llama-server +docker compose pull +docker compose up -d ``` ## Backup Honcho memory diff --git a/tests/smoke.sh b/tests/smoke.sh index 6337fdc..5a94b72 100644 --- a/tests/smoke.sh +++ b/tests/smoke.sh @@ -1,6 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -cd /home/j1admin/StackDeploy +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" echo '=== Service checks ===' curl -s -o /dev/null -w 'searxng=%{http_code}\n' 'http://localhost:8080/search?format=json&q=test' @@ -17,7 +18,7 @@ curl -s -X POST http://localhost:9377/tabs -H 'Content-Type: application/json' - python3 -c 'import json,sys; d=json.load(open("/tmp/sd_camofox_tab.json")); print("tabId=", d.get("tabId")); assert d.get("tabId"), "tabId missing"' echo '=== CloakBrowser CLI ===' -node /home/j1admin/StackDeploy/browser-search/scripts/cloak/cloak-fetch.mjs --help > /dev/null 2>&1 +node "$REPO_ROOT/browser-search/scripts/cloak/cloak-fetch.mjs" --help > /dev/null 2>&1 echo '=== Obsidian page ===' curl -s http://localhost:8083/ | grep -q 'Obsidian v1.7.7' From 628831daa40bde13acc9c8766f550c0d2e30cc16 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:55:29 -0400 Subject: [PATCH 04/10] chore: remove stale .patched files from noc-dashboard Remove healthcheck.sh.patched and docker-compose.headroom.yml.patched which are artifacts of a previous patching process and no longer needed. --- .../docker-compose.headroom.yml.patched | 79 ------------------- noc-dashboard/healthcheck.sh.patched | 52 ------------ 2 files changed, 131 deletions(-) delete mode 100644 noc-dashboard/docker-compose.headroom.yml.patched delete mode 100644 noc-dashboard/healthcheck.sh.patched diff --git a/noc-dashboard/docker-compose.headroom.yml.patched b/noc-dashboard/docker-compose.headroom.yml.patched deleted file mode 100644 index 854ad95..0000000 --- a/noc-dashboard/docker-compose.headroom.yml.patched +++ /dev/null @@ -1,79 +0,0 @@ -services: - # --- Headroom / Aphrodite proxy + memory stack --- - # Composite command: - # docker compose -f docker-compose.yml -f docker-compose.headroom.yml up -d - headroom-proxy: - build: - context: vendor/headroom - dockerfile: Dockerfile - command: ["--host", "0.0.0.0"] - ports: - - "8787:8787" - env_file: - - .env.headroom - environment: - - HEADROOM_HOST=0.0.0.0 - - OPENAI_TARGET_API_URL=${HEADROOM_OPENAI_TARGET_API_URL:-} - volumes: - - headroom_workspace:/home/nonroot/.headroom - healthcheck: - test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8787/readyz || exit 1"] - interval: 30s - timeout: 5s - retries: 3 - start_period: 20s - depends_on: - headroom-qdrant: - condition: service_healthy - headroom-neo4j: - condition: service_healthy - restart: unless-stopped - - headroom-qdrant: - image: qdrant/qdrant:v1.17.1 - container_name: headroom-qdrant - # Host ports remapped to 6335/6336 — the main "qdrant" service already owns - # 6333/6334 on the host. Internal container ports are unchanged, so - # QDRANT__SERVICE__GRPC_PORT below and the healthcheck (which curls - # localhost:6333 *inside* this container) still work as-is. - ports: - - "127.0.0.1:6335:6333" - - "127.0.0.1:6336:6334" - volumes: - - headroom-qdrant-data:/qdrant/storage - environment: - - QDRANT__SERVICE__GRPC_PORT=6334 - healthcheck: - test: ["CMD-SHELL", "curl -sf http://127.0.0.1:6333/healthz || exit 1"] - interval: 15s - timeout: 5s - retries: 3 - start_period: 20s - restart: unless-stopped - - headroom-neo4j: - image: neo4j:5.26 - container_name: headroom-neo4j - ports: - - "127.0.0.1:7474:7474" - - "127.0.0.1:7687:7687" - volumes: - - headroom-neo4j-data:/data - environment: - - NEO4J_AUTH=${NEO4J_AUTH:-neo4j/CHANGEME} - - NEO4J_PLUGINS=["apoc"] - - NEO4J_apoc_export_file_enabled=true - - NEO4J_apoc_import_file_enabled=true - - NEO4J_apoc_import_file_use__neo4j__config=true - healthcheck: - test: ["CMD-SHELL", "curl -sf http://127.0.0.1:7474/ || exit 1"] - interval: 15s - timeout: 5s - retries: 3 - start_period: 30s - restart: unless-stopped - -volumes: - headroom_workspace: - headroom-qdrant-data: - headroom-neo4j-data: diff --git a/noc-dashboard/healthcheck.sh.patched b/noc-dashboard/healthcheck.sh.patched deleted file mode 100644 index ff9e6d4..0000000 --- a/noc-dashboard/healthcheck.sh.patched +++ /dev/null @@ -1,52 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -SERVER="${1:-localhost}" -printf "StackDeploy Healthcheck\nTarget: %s\n\n" "$SERVER" - -check_service() { - local name="$1" - local url="$2" - local expected="${3:-}" - - if [[ -n "$expected" ]]; then - if curl -sf "$url" | grep -q "$expected"; then - printf " ✅ %s\n" "$name" - return 0 - fi - else - if curl -sf "$url" >/dev/null; then - printf " ✅ %s\n" "$name" - return 0 - fi - fi - printf " ❌ %s\n" "$name" - return 1 -} - -FAILED=0 - -echo "Core Infrastructure:" -check_service "SearXNG" "http://$SERVER:8080/search?q=healthcheck&format=json" "results" || FAILED=1 -check_service "Camofox" "http://$SERVER:9377/health" "ok" || FAILED=1 -check_service "CloakBrowser" "http://$SERVER:9222/json/version" "Browser" || FAILED=1 -check_service "Obsidian" "http://$SERVER:8083/" "Obsidian" || FAILED=1 -check_service "Qdrant" "http://$SERVER:6333/readyz" "ready" || FAILED=1 - -echo "" -echo "Memory Layer:" -check_service "Honcho API" "http://$SERVER:8081/healthz" "" || FAILED=1 - -echo "" -echo "Admin:" -check_service "Portainer" "http://$SERVER:9000/" "" || FAILED=1 -check_service "J1-NOC Dashboard" "http://$SERVER:9500/api/healthz" "ok" || FAILED=1 - -echo "" -if [[ $FAILED -eq 0 ]]; then - echo "🎉 All services healthy!" - exit 0 -else - echo "⚠️ Some services are down" - exit 1 -fi \ No newline at end of file From 169571ec47d63679a3498d68a72ddff5aac3a429 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:55:55 -0400 Subject: [PATCH 05/10] fix(security): replace hardcoded SearXNG secret key with env var Replace hardcoded 'stackdeploy-searxng' secret key in searxng/settings.yml with a placeholder and add SEARXNG_SECRET_KEY env var to docker-compose.yml. Document the new variable in README environment variables table. --- README.md | 1 + docker-compose.yml | 2 ++ searxng/settings.yml | 3 ++- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2755266..09f30f7 100644 --- a/README.md +++ b/README.md @@ -179,6 +179,7 @@ All secrets in `.env` (never committed). See `.env.example` for full list. | Variable | Purpose | Required | |----------|---------|----------| +| `SEARXNG_SECRET_KEY` | SearXNG secret key for session signing | Optional | | `HONCHO_DB_PASSWORD` | PostgreSQL password for Honcho | Yes | | `CAMOFOX_API_KEY` | Camofox auth key | Optional | | `CAMOFOX_ADMIN_KEY` | Camofox admin key | Optional | diff --git a/docker-compose.yml b/docker-compose.yml index e61818d..4e8667a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,6 +7,8 @@ services: restart: unless-stopped ports: - "8080:8080" + environment: + - SEARXNG_SECRET_KEY=${SEARXNG_SECRET_KEY:-changeme} healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/"] interval: 30s diff --git a/searxng/settings.yml b/searxng/settings.yml index b7abe30..29344b7 100644 --- a/searxng/settings.yml +++ b/searxng/settings.yml @@ -2,7 +2,8 @@ use_default_settings: true server: bind_address: "0.0.0.0" port: 8080 - secret_key: "stackdeploy-searxng" + # Set via SEARXNG_SECRET_KEY environment variable in docker-compose.yml + secret_key: "changeme" public_instance: false search: formats: From 8a3611ac8adb2f941e7e8d57ff212e353fba63c4 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:56:05 -0400 Subject: [PATCH 06/10] fix(ci): remove TypeScript from CodeQL language matrix No .ts or .tsx files exist in the repo. TypeScript was a template vestige that would cause an unnecessary CodeQL analysis pass. --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 707e2e6..e6763d6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: strategy: fail-fast: false matrix: - language: ['python', 'javascript', 'typescript'] + language: ['python', 'javascript'] steps: - name: Checkout repository From 73f437fac42e6aad611fec02d421125c07e4a8fb Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 20:56:08 -0400 Subject: [PATCH 07/10] chore: add reports/ to .gitignore Prevent pipeline-generated reports from appearing as untracked files. --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 21dd11c..da886ba 100644 --- a/.gitignore +++ b/.gitignore @@ -20,4 +20,6 @@ build/ *.so # Logs *.log +# Pipeline reports +reports/ profiles/local/.env From 40c54cc0de43612771a24815f902b211a4582436 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Sun, 5 Jul 2026 21:36:40 -0400 Subject: [PATCH 08/10] =?UTF-8?q?docs(oracle):=20add=20INTENT.md=20?= =?UTF-8?q?=E2=80=94=20J1-PIPELINE=20ORACLE=20phase=20intent=20reconstruct?= =?UTF-8?q?ion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- INTENT.md | 213 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 213 insertions(+) create mode 100644 INTENT.md diff --git a/INTENT.md b/INTENT.md new file mode 100644 index 0000000..050d581 --- /dev/null +++ b/INTENT.md @@ -0,0 +1,213 @@ +# INTENT.md — J1-PIPELINE Phase -1 (ORACLE) + +**Repository:** `OneByJorah/arah` +**Analysis Date:** 2026-07-05 +**Analyst:** J1-PIPELINE ORACLE (read-only) +**Status:** Intent Reconstructed + +--- + +## What This System Does + +### Technical Role + +**arah** (branded internally as **StackDeploy v2.0**) is a **unified, production-ready Docker Compose deployment** that consolidates the full self-hosted infrastructure stack for an autonomous AI agent (Hermes Agent) under a single IP with centralized management. It bundles services across five functional categories: + +| Category | Services | Ports | +|----------|----------|-------| +| **Search & Browser** | SearXNG (privacy metasearch), Camofox (stealth browser API), CloakBrowser (stealth browser for protected sites), Selenium WebAutomation | 8080, 9377, 9222, 4444 | +| **Memory & Knowledge** | Honcho API (long-term agent memory) + pgvector/Redis, Qdrant (vector database) | 8081, 5432, 6379, 6333 | +| **Notes & Docs** | Obsidian Remote (web-based vault) | 8083 | +| **Admin & Ops** | Portainer CE (full container lifecycle, RBAC, backups), NOC Dashboard (read-only unified health monitoring) | 9000/9443, 9500 | +| **Inference** | Ollama Cloud (optional, accessed over Tailscale from separate host) | 11434 | + +### Operational Role + +arah is the **infrastructure substrate** for the JorahOne ecosystem's AI agent operations. It provides: + +1. **Private web search** — SearXNG metasearch so Hermes can search the web without leaking queries to Google/Bing. +2. **Stealth browser automation** — Camofox + CloakBrowser for programmatic web browsing that evades bot detection (Cloudflare, Akamai, DataDome), enabling Hermes to interact with protected sites. +3. **Long-term agent memory** — Honcho (PostgreSQL + pgvector + Redis) for persistent conversation history, session context, vector embeddings, and multi-level reasoning (dialectic) across Hermes sessions. +4. **Vector storage** — Qdrant for similarity search and RAG-style retrieval. +5. **Graph memory** — Optional Headroom overlay (Neo4j + Qdrant) for structured knowledge graphs and Aphrodite proxy. +6. **Note-taking** — Obsidian Remote for persistent knowledge management accessible via Hermes skills. +7. **Unified monitoring** — NOC Dashboard polls every service's real health endpoints with latency sparklines, and optionally integrates Portainer container stats. +8. **Centralized admin** — Portainer for visual container lifecycle management (start/stop, logs, stats, volumes, networks, RBAC, backup). +9. **Setup automation** — CLI wizard + optional web setup API for four access modes (local, Tailscale, Cloudflare Tunnel, all). +10. **Hermes Agent skills** — The repo ships first-class Hermes Agent skills (`obsidian-skills/`, `browser-search/SKILL.md`) that teach Hermes how to use these services. + +--- + +## Why This Was Built + +### Real Problem + +AI agents like Hermes need local infrastructure to operate autonomously — private search, persistent memory, browser automation, and note-taking — without depending on external SaaS providers that compromise privacy, introduce latency, or impose usage limits. Running these services individually requires significant manual configuration, and no single open-source stack existed that bundled them into a cohesive, production-ready deployment. + +The web is also increasingly hostile to automation — Cloudflare, Akamai, DataDome, and other anti-bot systems block simple HTTP requests. A single browser automation tool is insufficient; the stack needs escalation from lightweight search → standard browsing → stealth browsing. + +### Why Existing Tools Were Insufficient + +- **SearXNG alone** provides search but no memory, browsing, or note-taking. +- **Honcho alone** provides agent memory but no search or browser. +- **Camofox/Playwright alone** provides browser automation but no memory or search. +- **Obsidian alone** provides notes but no agent integration. +- **Portainer alone** provides container management but no service-level health monitoring. +- **No existing project** combined all of these into a single `docker compose` stack with health checks, CI/CD, zero-secrets-in-git policy, multi-mode networking (local/Tailscale/Cloudflare), and Hermes Agent skill integration. +- **browser-search** (the search/browse skill) was originally a standalone project — it was folded into arah to provide a complete, pre-integrated agent infrastructure package. + +### What Triggered Development + +The development of Hermes Agent (Nous Research's autonomous AI assistant) created an immediate need for a self-hosted "brain stack" — a production-ready environment where an AI agent can search the web, remember past conversations, browse websites programmatically, and maintain a knowledge base, all running on local consumer hardware (RTX 3060 12GB, Ubuntu 22.04+). The initial commit (`1350265` — "Initial full‑stack commit") established the full stack, and subsequent commits added setup automation, monitoring, security hardening, and ecosystem integration. + +### JorahOne Ecosystem Fit + +arah is the **infrastructure layer** of the JorahOne ecosystem: + +``` +JorahOne Ecosystem +├── arah (StackDeploy) ← Infrastructure: search, memory, browser, notes, monitoring +├── Honcho ← Agent memory engine (upstream: plastic-labs/honcho) +├── Headroom ← Graph memory / Aphrodite proxy (upstream: headroomlabs-ai/headroom) +├── CostForge ← Cost tracking (planned, empty dir) +├── hermes-brain-stack ← Brain stack integration (planned, empty dir) +├── Hermes Agent ← AI agent that consumes all of the above +└── browser-search ← Standalone search/browse skill (folded into arah) +``` + +arah provides the **self-hosted services** that Hermes Agent's web search, memory, browser, and note-taking capabilities depend on. Without arah, Hermes would need external SaaS for every capability. With arah, the entire agent infrastructure runs on local hardware behind Tailscale, with zero external dependencies for core operations. + +--- + +## Operational Classification + +**Classification: PRODUCTION** + +Evidence: + +- **Version:** v2.0, explicitly labeled "Production Ready" in README. +- **Health checks:** Every service has Docker healthchecks with retry logic; `scripts/healthcheck.sh` validates all 9+ services. +- **CI/CD:** GitHub Actions pipeline (CodeQL weekly scanning), Dependabot configured for pip/npm/docker/github-actions. +- **Security posture:** Zero secrets in git (`.env` gitignored, `.env.example` has placeholders), non-root containers, read-only mounts, network isolation, Tailscale encryption. +- **Security audits:** Two security commits in git history — `7fac97d` redacted hardcoded Tailscale IPs, `a06767a` sanitized j1admin email references. +- **Monitoring:** NOC Dashboard provides real-time health polling with latency sparklines and Portainer integration. +- **Backup:** Portainer backup/restore, Docker volumes for persistent data (honcho-pgdata, honcho-redis-data, portainer-data). +- **Deployment automation:** Bootstrap script, setup wizard (CLI + web), apply script, four access modes (local/Tailscale/Cloudflare/all). +- **Live deployment:** `live-manifest.json` documents an active production deployment with all services verified as "up" on a Tailscale network. +- **Community readiness:** CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, issue templates (bug + feature), PR template, Dependabot config, MIT license. + +--- + +## Key Architectural Decisions + +1. **Single IP, direct ports** — No reverse proxy or API gateway. Every service exposes its own port directly. The NOC Dashboard is read-only monitoring, not a proxy. This simplifies debugging and avoids a single point of failure. + +2. **Compose overlays** — Honcho, Headroom, Portainer, and NOC Dashboard are separate compose files that compose on top of the base `docker-compose.yml`. Users opt in to what they need. This keeps the base stack lean and allows independent lifecycle management. + +3. **Zero secrets in git** — All secrets go in `.env` (gitignored). `.env.example` documents the schema. Profile-based `.env` files under `profiles/` are selected at setup time. The repo has been audited to remove hardcoded IPs and emails. + +4. **Hermes-first design** — The entire stack is designed to be consumed by Hermes Agent. Skills, API endpoints, and config examples all target Hermes. The `browser-search` skill was folded in from a standalone project to provide pre-integrated search/browse capabilities. + +5. **CPU-first with GPU option** — Runs on CPU by default; GPU inference (Ollama) is accessed over Tailscale from a separate host. This keeps the stack deployable on consumer hardware. + +6. **Multi-mode networking** — Four access modes (local, Tailscale, Cloudflare Tunnel, all) selected at setup time via CLI wizard or web UI. Cloudflare Tunnel config is generated dynamically with per-service path routing. + +7. **Portainer as admin panel** — Rather than building a custom admin UI, the stack uses Portainer CE for container lifecycle management. This was a deliberate decision to avoid reinventing container management — Portainer provides RBAC, logs, stats, backups, and stack deployment out of the box. + +8. **Three-tier browser escalation** — SearXNG (fast search) → Camofox (REST API browser for standard sites) → CloakBrowser (stealth Chromium for anti-bot protected sites). The agent automatically escalates when a tool fails. + +--- + +## Repository Structure + +``` +arah/ +├── docker-compose.yml # Base: SearXNG, Qdrant, Honcho, Obsidian, WebAutomation +├── docker-compose.honcho.yml # Overlay: Honcho API + pgvector + Redis +├── docker-compose.headroom.yml # Overlay: Headroom proxy + Qdrant + Neo4j +├── docker-compose.portainer.yml # Overlay: Portainer CE admin panel +├── bootstrap.sh # One-command deploy +├── live-manifest.json # Live deployment topology (Tailscale IPs redacted) +├── scripts/ +│ ├── bootstrap.sh # Pull images, start stack, healthcheck +│ ├── healthcheck.sh # Validates all services via HTTP/TCP +│ ├── setup-wizard.sh # CLI mode selection + Cloudflare config +│ ├── apply-setup.sh # Applies profile + Cloudflare config + restart +│ ├── init-honcho.sh # Honcho env + config initialization +│ ├── init-obsidian.sh # Obsidian vault initialization +│ ├── init-headroom.sh # Headroom env initialization +│ ├── install.sh # Python venv setup +│ └── install-browser-search.sh # npm install for browser-search +├── docs/ +│ ├── SERVER_SETUP.md # Server prerequisites and install +│ ├── HERMES_SETUP.md # Hermes Agent config for local services +│ ├── HONCHO_SETUP.md # Honcho submodule + API key setup +│ ├── HEADROOM_SETUP.md # Headroom overlay setup +│ ├── SETUP_WIZARD.md # CLI + web setup wizard docs +│ ├── MAINTENANCE.md # Restart, update, backup commands +│ └── hermes.md # Hermes service interaction reference +├── profiles/ +│ ├── local/.env.example # Local-only mode env +│ ├── tailscale/.env # Tailscale mode env +│ ├── cloudflare/.env # Cloudflare Tunnel mode env +│ └── all/.env # All modes combined env +├── browser-search/ # Standalone search/browse skill package +│ ├── SKILL.md # Hermes Agent skill for search/browse +│ ├── README.md # Multi-language README (11 languages) +│ ├── package.json # npm package (CloakBrowser) +│ ├── scripts/ # Camofox + CloakBrowser scripts +│ └── docker/ # Docker setup docs +├── obsidian-skills/ # Hermes Agent skills for Obsidian +│ ├── obsidian-cli/SKILL.md +│ ├── obsidian-markdown/SKILL.md +│ ├── obsidian-bases/SKILL.md +│ ├── defuddle/SKILL.md +│ └── json-canvas/SKILL.md +├── noc-dashboard/ # FastAPI monitoring dashboard +│ ├── Dockerfile +│ ├── docker-compose.dashboard.yml +│ ├── docker-compose.portainer.yml +│ ├── backend/app.py # Main dashboard backend +│ ├── backend/standalone.py # Standalone (no Docker) version +│ ├── frontend/index.html # Amber-themed monitoring UI +│ └── templates/setup.html # Web setup wizard UI +├── honcho/ +│ ├── config.toml # Honcho LLM provider config +│ ├── honcho-config.json # Hermes Honcho client config +│ └── .env.honcho.example # Honcho API key template +├── headroom/ +│ └── headroom-config.example # Headroom runtime config example +├── searxng/ +│ └── settings.yml # SearXNG config (JSON format, public_instance: false) +├── CostForge/ # Cost tracking (empty, planned) +├── hermes-brain-stack/ # Brain stack integration (empty, planned) +├── tests/ +│ └── smoke.sh # End-to-end smoke test +├── test_results.txt # Historical test output +├── .github/ +│ ├── workflows/codeql.yml # CodeQL weekly security scan +│ ├── dependabot.yml # Weekly dependency updates (pip, npm, docker, actions) +│ ├── ISSUE_TEMPLATE/bug_report.md +│ ├── ISSUE_TEMPLATE/feature_request.md +│ └── PULL_REQUEST_TEMPLATE.md +├── CODE_OF_CONDUCT.md # Contributor Covenant v2.1 +├── CONTRIBUTING.md # Contribution guidelines +├── SECURITY.md # 90-day disclosure policy +├── LICENSE # MIT +├── .gitignore # .env, __pycache__, node_modules, etc. +└── README.md # StackDeploy v2.0 README +``` + +--- + +## Notes + +- **Naming discrepancy:** The repo's GitHub name is **arah** but the README brand is **StackDeploy v2.0**. This should be resolved in a future phase. +- **Empty directories:** `CostForge/` and `hermes-brain-stack/` exist but are empty — planned future additions for cost tracking and brain stack integration. +- **Missing submodules:** `vendor/honcho` and `vendor/headroom` are referenced in compose files but not currently checked into the repo. The compose files reference `context: vendor/honcho` and `context: vendor/headroom` for building from source, but these directories don't exist. +- **Portainer service gap:** Portainer was referenced in the README and healthcheck script but had no compose definition until `docker-compose.portainer.yml` was added (noted in the file's own comment: "was never actually defined as a service — this fills that gap"). +- **Dependabot config drift:** Dependabot is configured for `pip` at directory `/`, but there is no `requirements.txt` at the repo root — only in `noc-dashboard/backend/`. The `npm` and `docker` ecosystems are correctly configured. This is a minor template vestige. +- **Security audit history:** Two security commits in git history — `7fac97d` (redacted hardcoded Tailscale IPs) and `a06767a` (sanitized j1admin email references). This is a positive maturity signal. +- **browser-search provenance:** The `browser-search/` subdirectory is a standalone open-source project (MIT, 11-language README) that was folded into arah. It has its own `package.json`, `SKILL.md`, and multi-language documentation. +- **Live deployment:** `live-manifest.json` documents a real production deployment with Tailscale networking, all services verified as "up", and a `CostForge` service listed as "pending". +- **Honcho config.toml** is extensively configured with multi-tier LLM providers (vllm primary, custom backup), dialectic reasoning levels (minimal through max), memory consolidation ("dream"), and session summarization — all targeting Hermes Agent integration. From 821960c9bbacdc54fa919d3dcebc288b70c96047 Mon Sep 17 00:00:00 2001 From: J1-PIPELINE Date: Tue, 7 Jul 2026 19:35:12 -0400 Subject: [PATCH 09/10] =?UTF-8?q?Rename=20arah=20=E2=86=92=20AutoStack:=20?= =?UTF-8?q?update=20remote=20URL,=20README=20references,=20and=20internal?= =?UTF-8?q?=20references?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Updated git remote from OneByJorah/arah to OneByJorah/AutoStack - Updated INTENT.md: all 'arah' references → 'AutoStack', resolved naming discrepancy note - Updated live-manifest.json: repo name, URL, tunnel hostname - Updated noc-dashboard/templates/setup.html: title, heading, placeholders - Updated docs/SETUP_WIZARD.md: description and Cloudflare URL - Updated scripts/setup-wizard.sh and scripts/apply-setup.sh: echo text --- INTENT.md | 22 +++++++++++----------- docs/SETUP_WIZARD.md | 4 ++-- live-manifest.json | 6 +++--- noc-dashboard/templates/setup.html | 8 ++++---- scripts/apply-setup.sh | 2 +- scripts/setup-wizard.sh | 2 +- 6 files changed, 22 insertions(+), 22 deletions(-) diff --git a/INTENT.md b/INTENT.md index 050d581..9700da7 100644 --- a/INTENT.md +++ b/INTENT.md @@ -1,6 +1,6 @@ # INTENT.md — J1-PIPELINE Phase -1 (ORACLE) -**Repository:** `OneByJorah/arah` +**Repository:** `OneByJorah/AutoStack` **Analysis Date:** 2026-07-05 **Analyst:** J1-PIPELINE ORACLE (read-only) **Status:** Intent Reconstructed @@ -11,7 +11,7 @@ ### Technical Role -**arah** (branded internally as **StackDeploy v2.0**) is a **unified, production-ready Docker Compose deployment** that consolidates the full self-hosted infrastructure stack for an autonomous AI agent (Hermes Agent) under a single IP with centralized management. It bundles services across five functional categories: +**AutoStack** (branded internally as **StackDeploy v2.0**) is a **unified, production-ready Docker Compose deployment** that consolidates the full self-hosted infrastructure stack for an autonomous AI agent (Hermes Agent) under a single IP with centralized management. It bundles services across five functional categories: | Category | Services | Ports | |----------|----------|-------| @@ -23,7 +23,7 @@ ### Operational Role -arah is the **infrastructure substrate** for the JorahOne ecosystem's AI agent operations. It provides: +AutoStack is the **infrastructure substrate** for the JorahOne ecosystem's AI agent operations. It provides: 1. **Private web search** — SearXNG metasearch so Hermes can search the web without leaking queries to Google/Bing. 2. **Stealth browser automation** — Camofox + CloakBrowser for programmatic web browsing that evades bot detection (Cloudflare, Akamai, DataDome), enabling Hermes to interact with protected sites. @@ -54,7 +54,7 @@ The web is also increasingly hostile to automation — Cloudflare, Akamai, DataD - **Obsidian alone** provides notes but no agent integration. - **Portainer alone** provides container management but no service-level health monitoring. - **No existing project** combined all of these into a single `docker compose` stack with health checks, CI/CD, zero-secrets-in-git policy, multi-mode networking (local/Tailscale/Cloudflare), and Hermes Agent skill integration. -- **browser-search** (the search/browse skill) was originally a standalone project — it was folded into arah to provide a complete, pre-integrated agent infrastructure package. +- **browser-search** (the search/browse skill) was originally a standalone project — it was folded into AutoStack to provide a complete, pre-integrated agent infrastructure package. ### What Triggered Development @@ -62,20 +62,20 @@ The development of Hermes Agent (Nous Research's autonomous AI assistant) create ### JorahOne Ecosystem Fit -arah is the **infrastructure layer** of the JorahOne ecosystem: +AutoStack is the **infrastructure layer** of the JorahOne ecosystem: ``` JorahOne Ecosystem -├── arah (StackDeploy) ← Infrastructure: search, memory, browser, notes, monitoring +├── AutoStack (StackDeploy) ← Infrastructure: search, memory, browser, notes, monitoring ├── Honcho ← Agent memory engine (upstream: plastic-labs/honcho) ├── Headroom ← Graph memory / Aphrodite proxy (upstream: headroomlabs-ai/headroom) ├── CostForge ← Cost tracking (planned, empty dir) ├── hermes-brain-stack ← Brain stack integration (planned, empty dir) ├── Hermes Agent ← AI agent that consumes all of the above -└── browser-search ← Standalone search/browse skill (folded into arah) +└── browser-search ← Standalone search/browse skill (folded into AutoStack) ``` -arah provides the **self-hosted services** that Hermes Agent's web search, memory, browser, and note-taking capabilities depend on. Without arah, Hermes would need external SaaS for every capability. With arah, the entire agent infrastructure runs on local hardware behind Tailscale, with zero external dependencies for core operations. +AutoStack provides the **self-hosted services** that Hermes Agent's web search, memory, browser, and note-taking capabilities depend on. Without AutoStack, Hermes would need external SaaS for every capability. With AutoStack, the entire agent infrastructure runs on local hardware behind Tailscale, with zero external dependencies for core operations. --- @@ -121,7 +121,7 @@ Evidence: ## Repository Structure ``` -arah/ +AutoStack/ ├── docker-compose.yml # Base: SearXNG, Qdrant, Honcho, Obsidian, WebAutomation ├── docker-compose.honcho.yml # Overlay: Honcho API + pgvector + Redis ├── docker-compose.headroom.yml # Overlay: Headroom proxy + Qdrant + Neo4j @@ -202,12 +202,12 @@ arah/ ## Notes -- **Naming discrepancy:** The repo's GitHub name is **arah** but the README brand is **StackDeploy v2.0**. This should be resolved in a future phase. +- **Naming resolved:** The repo's GitHub name is now **AutoStack** matching the README brand **StackDeploy v2.0**. - **Empty directories:** `CostForge/` and `hermes-brain-stack/` exist but are empty — planned future additions for cost tracking and brain stack integration. - **Missing submodules:** `vendor/honcho` and `vendor/headroom` are referenced in compose files but not currently checked into the repo. The compose files reference `context: vendor/honcho` and `context: vendor/headroom` for building from source, but these directories don't exist. - **Portainer service gap:** Portainer was referenced in the README and healthcheck script but had no compose definition until `docker-compose.portainer.yml` was added (noted in the file's own comment: "was never actually defined as a service — this fills that gap"). - **Dependabot config drift:** Dependabot is configured for `pip` at directory `/`, but there is no `requirements.txt` at the repo root — only in `noc-dashboard/backend/`. The `npm` and `docker` ecosystems are correctly configured. This is a minor template vestige. - **Security audit history:** Two security commits in git history — `7fac97d` (redacted hardcoded Tailscale IPs) and `a06767a` (sanitized j1admin email references). This is a positive maturity signal. -- **browser-search provenance:** The `browser-search/` subdirectory is a standalone open-source project (MIT, 11-language README) that was folded into arah. It has its own `package.json`, `SKILL.md`, and multi-language documentation. +- **browser-search provenance:** The `browser-search/` subdirectory is a standalone open-source project (MIT, 11-language README) that was folded into AutoStack. It has its own `package.json`, `SKILL.md`, and multi-language documentation. - **Live deployment:** `live-manifest.json` documents a real production deployment with Tailscale networking, all services verified as "up", and a `CostForge` service listed as "pending". - **Honcho config.toml** is extensively configured with multi-tier LLM providers (vllm primary, custom backup), dialectic reasoning levels (minimal through max), memory consolidation ("dream"), and session summarization — all targeting Hermes Agent integration. diff --git a/docs/SETUP_WIZARD.md b/docs/SETUP_WIZARD.md index 2a25e4a..bb45e10 100644 --- a/docs/SETUP_WIZARD.md +++ b/docs/SETUP_WIZARD.md @@ -1,6 +1,6 @@ # Setup Wizard -arah supports four access modes. Choose one at install time, or switch later by updating `.env`. +AutoStack supports four access modes. Choose one at install time, or switch later by updating `.env`. - `local` — no tunnels, no tailscale, no cloudflare; services reachable on localhost ports only. - `tailscale` — services exposed over Tailscale only. @@ -25,7 +25,7 @@ ENABLE_SETUP_API=1 docker compose -f docker-compose.yml -f noc-dashboard/docker- Then open: - `http://localhost:9500/setup` -- Or, if the Cloudflare tunnel is active: `https://arah..com/setup` +- Or, if the Cloudflare tunnel is active: `https://autostack..com/setup` Select mode, enter tokens/tunnel info, and submit. diff --git a/live-manifest.json b/live-manifest.json index 0fc136a..c1a6755 100644 --- a/live-manifest.json +++ b/live-manifest.json @@ -1,9 +1,9 @@ { "updated_at": "2026-07-03T03:45:00Z", "tailscale_ip": "[REDACTED]", - "github_repo": "OneByJorah/arah", - "repo_url": "https://github.com/OneByJorah/arah", - "tunnel_hostname": "arah..com", + "github_repo": "OneByJorah/AutoStack", + "repo_url": "https://github.com/OneByJorah/AutoStack", + "tunnel_hostname": "autostack..com", "services": { "honcho": { "container": "honcho-self-hosted_redis_1", diff --git a/noc-dashboard/templates/setup.html b/noc-dashboard/templates/setup.html index 3cd2d22..fee49a3 100644 --- a/noc-dashboard/templates/setup.html +++ b/noc-dashboard/templates/setup.html @@ -2,7 +2,7 @@ - arah setup + AutoStack setup