configs-all 1.0.0

package/docs/retros/2026-03-01-ai-stack-split-architecture.md

@@ -0,0 +1,38 @@
+# Retro: AI Stack Split Architecture
+
+_Date: 2026-03-01_
+_Plan: docs/plans/2026-03-01-ai-stack-split-architecture.md_
+
+## What Worked
+
+- **wolfe-server's existing service pattern** (docker-compose + .env + .service + unpack.sh) made adding 5 new services systematic and predictable. Following the pattern meant no guesswork.
+- **Parallel verification agents** caught all issues simultaneously — saved significant time vs. sequential debugging.
+- **LAN IP fallback** (192.168.0.5) immediately resolved the Tailscale ACL issue without needing admin console access. Both machines on same LAN makes this reliable.
+- **Deploy script + rsync** for mikpc worked cleanly — single command to update and restart GPU services.
+
+## What Didn't Work
+
+- **Port 3000 conflict** — AdGuard Home already uses port 3000 on wolfe-server. Not caught until first deployment because the research phase didn't check `docker ps` for existing port mappings. **Fix**: Research phase should always check existing port allocations before assigning new ones.
+- **unpack.sh `set -euo pipefail`** — one service failure (Open WebUI port conflict) stopped all remaining services from deploying. The configs repo's push-configs.zsh intentionally avoids `set -e` for this reason, but wolfe-server uses it. This caused 3 services to not deploy on first run.
+- **ACE-Step model checkpoints in container layer** — without a named volume, model weights (~4GB) were lost on container recreate, causing crash loops and multi-minute re-downloads. **Fix applied**: added `ace-step-checkpoints` named volume.
+- **Tailscale ACL blocking `tag:wolfe`** — wolfe-server is tagged, not user-owned, so it's excluded from the default ACL allow list. This blocked ALL TCP from wolfe-server to mikpc via Tailscale. The Windows Firewall was a red herring initially.
+
+## What Was Surprising
+
+- **Mac reaches mikpc via Tailscale but wolfe-server can't** — both are on the same network, but the ACL discriminates based on device ownership (user-owned vs tagged). Easy to assume "if Mac works, everything works."
+- **`docker compose up -d` doesn't recreate on .env changes** — need `--force-recreate` when env files change. This is documented Docker behavior but easy to forget.
+- **n8n permissions** — runs as uid 1000 (node user) but data dirs created by root. Need `chown 1000:1000` before first start.
+
+## Learnings for Future Sessions
+
+1. **Always check existing port allocations** before adding services to any machine: `docker ps --format '{{.Ports}}'`
+2. **GPU service model downloads need persistent volumes** — always mount checkpoint/model directories as named volumes
+3. **Tailscale ACL matters for tagged devices** — `tag:wolfe` doesn't get the same access as user-owned devices. Check ACL when debugging cross-machine connectivity.
+4. **Use LAN IP for co-located machines** — faster, simpler, avoids Tailscale ACL issues. Tailscale IP only needed for remote access from outside the LAN.
+5. **`set -euo pipefail` in deployment scripts means one failure = total failure** — design deployments to be resilient or at least know this behavior.
+
+## Open Items
+
+- **Tailscale ACL**: Add `tag:wolfe` to allowed sources at https://login.tailscale.com/admin/acls — this would fix Tailscale-based connectivity and is the proper long-term fix
+- **Perplexica config persistence**: Config resets on container restart. Could be solved by mounting a config volume or adding a post-start hook to the systemd service
+- **n8n Python runner**: Missing Python 3 in container — Python-based n8n nodes won't work. Not needed currently but worth noting

package/gh/config.yml

@@ -0,0 +1,16 @@
+# What protocol to use when performing git operations. Supported values: ssh, https
+git_protocol: ssh
+# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
+editor:
+# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
+prompt: enabled
+# A pager program to send command output to, e.g. "less". Set the value to "cat" to disable the pager.
+pager:
+# Aliases allow you to create nicknames for gh commands
+aliases:
+    co: pr checkout
+# The path to a unix socket through which send HTTP connections. If blank, HTTP traffic will be handled by net/http.DefaultTransport.
+http_unix_socket:
+# What web browser gh should use when opening URLs. If blank, will refer to environment.
+browser:
+version: "1"

package/gh/hosts.yml

@@ -0,0 +1,5 @@
+github.com:
+    git_protocol: ssh
+    user: chiefmikey
+    users:
+        chiefmikey:

package/gh/main.json

@@ -0,0 +1,103 @@
+{
+  "name": "main",
+  "target": "branch",
+  "source_type": "Repository",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "~DEFAULT_BRANCH"
+      ]
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": false,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": [
+          "merge",
+          "squash",
+          "rebase"
+        ]
+      }
+    },
+    {
+      "type": "copilot_code_review",
+      "parameters": {
+        "review_on_push": true,
+        "review_draft_pull_requests": true
+      }
+    },
+    {
+      "type": "copilot_code_review_analysis_tools",
+      "parameters": {
+        "tools": [
+          {
+            "name": "CodeQL"
+          },
+          {
+            "name": "ESLint"
+          },
+          {
+            "name": "PMD"
+          }
+        ]
+      }
+    },
+    {
+      "type": "code_quality",
+      "parameters": {
+        "severity": "errors"
+      }
+    },
+    {
+      "type": "code_scanning",
+      "parameters": {
+        "code_scanning_tools": [
+          {
+            "tool": "CodeQL",
+            "security_alerts_threshold": "high_or_higher",
+            "alerts_threshold": "errors"
+          }
+        ]
+      }
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": true,
+        "required_status_checks": [
+          {
+            "context": "Backend: Build and Test",
+            "integration_id": 15368
+          },
+          {
+            "context": "Backend: Policy Tests",
+            "integration_id": 15368
+          },
+          {
+            "context": "UI: Build and Test",
+            "integration_id": 15368
+          }
+        ]
+      }
+    }
+  ]
+}

package/ghostty/config

@@ -0,0 +1,90 @@
+# Ghostty Configuration — Mikey Pro theme (ported from iTerm2)
+# Equivalent to iTerm2 + WezTerm "Mikey Pro" setup
+
+# ─── Font ───────────────────────────────────────────────────────────────────────
+font-family = Menlo
+font-family = MesloLGS NF
+font-size = 16
+adjust-cell-height = 20%
+
+# ─── Colors — Mikey Pro (custom Monokai Pro variant) ────────────────────────────
+background = #1d1b1d
+foreground = #fcfcfa
+cursor-color = #7e6fb2
+cursor-text = #fcfcfa
+selection-foreground = #1d1b1d
+selection-background = #7e6fb2
+
+# ANSI normal
+palette = 0=#4f4e4f
+palette = 1=#9e475e
+palette = 2=#96c766
+palette = 3=#ddbd53
+palette = 4=#4f4e4f
+palette = 5=#7e6fb2
+palette = 6=#5dacb7
+palette = 7=#727072
+
+# ANSI bright
+palette = 8=#727072
+palette = 9=#ff6188
+palette = 10=#a9dc76
+palette = 11=#ffd866
+palette = 12=#727072
+palette = 13=#ab9df2
+palette = 14=#78dce8
+palette = 15=#727072
+
+# ─── Background Image ───────────────────────────────────────────────────────────
+# background-image = /Users/mikl/Dropbox/Other/sv/IMG_4525.JPG
+# background-image-opacity = 0.15
+# background-image-fit = cover
+# background-image-position = center
+
+# ─── Cursor ─────────────────────────────────────────────────────────────────────
+cursor-style = block
+cursor-style-blink = false
+
+# ─── Text ───────────────────────────────────────────────────────────────────────
+bold-color = bright
+minimum-contrast = 1.5
+
+# ─── Window ─────────────────────────────────────────────────────────────────────
+window-width = 160
+window-height = 60
+window-padding-x = 8
+window-padding-y = 8
+macos-titlebar-style = tabs
+window-save-state = always
+window-theme = dark
+title = " "
+
+# ─── Tabs & Splits ──────────────────────────────────────────────────────────────
+split-divider-color = #3d3b3d
+
+# ─── Terminal Behavior ──────────────────────────────────────────────────────────
+term = xterm-256color
+scrollback-limit = 10000000
+confirm-close-surface = false
+mouse-hide-while-typing = true
+copy-on-select = true
+shell-integration = detect
+shell-integration-features = no-cursor,sudo,title
+
+# ─── macOS ──────────────────────────────────────────────────────────────────────
+# Left Option sends Esc+ (for alt/meta key in shell), right Option stays normal
+macos-option-as-alt = left
+quit-after-last-window-closed = false
+
+# ─── Keybindings ────────────────────────────────────────────────────────────────
+# Defaults (matching iTerm2):
+#   Cmd+T/W/D/Shift+D/K/N, Cmd+1-9, Ctrl+Tab, Cmd+[/], Cmd+Enter
+#   Cmd+Shift+Enter → zoom focused split (toggle)
+#   Cmd+Shift+P     → command palette
+#   Cmd+Shift+J     → write scrollback to file (paste path)
+
+# Quick terminal (quake-style dropdown) — global hotkey
+keybind = global:super+grave_accent=toggle_quick_terminal
+
+# Pin terminal above all windows
+keybind = super+shift+f=toggle_window_float_on_top

package/git/config/base.gitconfig

@@ -0,0 +1,46 @@
+# Git Configuration - Shared Base Settings
+# This file contains common git configuration that applies to all profiles
+
+[core]
+	editor = code --wait
+
+[init]
+	defaultBranch = main
+	templatedir = ~/.git-templates
+
+[fetch]
+	prune = true
+
+[color]
+	ui = auto
+
+[push]
+	default = current
+
+[web]
+	browser = chrome
+
+[alias]
+	aliases = !git config --list | grep 'alias\\.' | sed 's/alias\\.\\([^=]*\\)=\\(.*\\)/\\1\\ \t => \\2/' | sort
+	dlm = !git fetch && git branch --merged | egrep -v 'master' | xargs git branch -d
+	lg = log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit --date=relative
+	hist = log --pretty=format:\"%h %ad | %s%d [%an]\" --graph --date=short
+	fwl = push --force-with-lease
+
+[commit]
+	gpgsign = true
+
+[gpg]
+	format = ssh
+
+[gpg "ssh"]
+	program = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign"
+
+[pull]
+	rebase = false
+
+[filter "lfs"]
+	clean = git-lfs clean -- %f
+	smudge = git-lfs smudge -- %f
+	process = git-lfs filter-process
+	required = true

package/git/config/chiefmikey.gitconfig

@@ -0,0 +1,11 @@
+# Git Configuration - chiefmikey (scoped include)
+# This config is only included for repos in /Users/mikl/Dropbox/duplo/dev/chiefmikey/
+
+[user]
+	name = chiefmikey
+	email = chiefmikey@users.noreply.github.com
+	signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGEDLKukaKrIbAJTyyVNMfHsEzn5AHBxlAiA5wqI9k75
+
+# Rewrite github.com URLs to use github-chiefmikey host (only applies in dev/chiefmikey dir)
+[url "git@github-chiefmikey:"]
+	insteadOf = git@github.com:

package/git/config/personal.gitconfig

@@ -0,0 +1,10 @@
+# Git Configuration - Personal Profile (mikbook host)
+# This file contains user-specific settings for personal projects
+
+[user]
+	name = Mikl Wolfe
+	email = wolfemikl@gmail.com
+	signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGEDLKukaKrIbAJTyyVNMfHsEzn5AHBxlAiA5wqI9k75
+
+[include]
+	path = ~/.config/git/base.gitconfig

package/git/config/work.gitconfig

@@ -0,0 +1,14 @@
+# Git Configuration - Work Profile (duplo host only)
+# Work identity and signing key - do not use on other machines
+
+[user]
+	name = Mikl Wolfe
+	email = wolfemikl+duplo@gmail.com
+	signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIgpIcLuet6LaYXPj7vVjoKSAAVYHRY/Ogi09723Yxh7
+
+[include]
+	path = ~/.config/git/base.gitconfig
+
+# Use chiefmikey identity for any repos under this directory tree (duplo host).
+[includeIf "gitdir:/Users/mikl/Dropbox/duplo/dev/chiefmikey/"]
+	path = ~/.config/git/chiefmikey.gitconfig

package/ide/cursor/extensions.txt

@@ -0,0 +1,111 @@
+angular.ng-template
+anysphere.cursorpyright
+anysphere.remote-containers
+anysphere.remote-ssh
+anysphere.remote-wsl
+arcanis.vscode-zipfs
+bierner.markdown-preview-github-styles
+bmalehorn.shell-syntax
+cezaraugusto.vscode-chrome-extesion-manifest-json-schema
+charliermarsh.ruff
+christian-kohler.npm-intellisense
+christian-kohler.path-intellisense
+codesee.maps
+danielthielking.aws-cloudformation-yaml
+dbaeumer.vscode-eslint
+dnicolson.binary-plist
+donjayamanne.githistory
+dotjoshjohnson.xml
+eamodio.gitlens
+ecmel.vscode-html-css
+editorconfig.editorconfig
+esbenp.prettier-vscode
+fabiospampinato.vscode-diff
+firsttris.vscode-jest-runner
+formulahendry.code-runner
+frumbasjt.chapel
+gitduck.code-streaming
+github.codespaces
+github.remotehub
+github.vscode-codeql
+github.vscode-github-actions
+github.vscode-pull-request-github
+grapecity.gc-excelviewer
+graphql.vscode-graphql
+graphql.vscode-graphql-execution
+graphql.vscode-graphql-syntax
+hbenl.vscode-test-explorer
+ibm.output-colorizer
+jakearl.vscode-sonic-pi
+jock.svg
+kakumei.ts-debug
+leizongmin.node-module-intellisense
+leodevbro.blockman
+mads-hartmann.bash-ide-vscode
+mechatroner.rainbow-csv
+mikestead.dotenv
+monokai.theme-monokai-pro-vscode
+mrmlnc.vscode-apache
+mrmlnc.vscode-scss
+ms-azuretools.vscode-containers
+ms-azuretools.vscode-docker
+ms-dotnettools.csdevkit
+ms-dotnettools.csharp
+ms-dotnettools.vscode-dotnet-pack
+ms-dotnettools.vscode-dotnet-runtime
+ms-dotnettools.vscodeintellicode-csharp
+ms-kubernetes-tools.vscode-kubernetes-tools
+ms-ossdata.vscode-pgsql
+ms-python.debugpy
+ms-python.isort
+ms-python.pylint
+ms-python.python
+ms-python.vscode-python-envs
+ms-vscode-remote.remote-ssh-edit
+ms-vscode-remote.vscode-remote-extensionpack
+ms-vscode.azure-repos
+ms-vscode.cmake-tools
+ms-vscode.cpptools
+ms-vscode.cpptools-extension-pack
+ms-vscode.cpptools-themes
+ms-vscode.powershell
+ms-vscode.remote-explorer
+ms-vscode.remote-repositories
+ms-vscode.remote-server
+ms-vscode.test-adapter-converter
+ms-vscode.vscode-speech
+ms-vscode.vscode-typescript-next
+ms-vsliveshare.vsliveshare
+msjsdiag.vscode-react-native
+mtxr.sqltools
+naumovs.color-highlight
+openai.chatgpt
+orta.vscode-jest
+redhat.vscode-yaml
+ritwickdey.liveserver
+rogalmic.zsh-debug
+s00500.sonic-pi-extension
+samuelcolvin.jinjahtml
+shanoor.vscode-nginx
+sonarsource.sonarlint-vscode
+spadin.zmk-tools
+streetsidesoftware.code-spell-checker
+stylelint.vscode-stylelint
+svelte.svelte-vscode
+sysoev.language-stylus
+tamasfe.even-better-toml
+timonwong.shellcheck
+tintinweb.vscode-decompiler
+tomoki1207.pdf
+tusaeff.vscode-iterm2-theme-sync
+vincaslt.highlight-matching-tag
+visualstudioexptteam.intellicode-api-usage-examples
+visualstudioexptteam.vscodeintellicode
+visualstudioexptteam.vscodeintellicode-completions
+visualstudioexptteam.vscodeintellicode-insiders
+visualstudiotoolsforunity.vstuc
+vue.volar
+wakatime.vscode-wakatime
+wmaurer.change-case
+yzhang.markdown-all-in-one
+zignd.html-css-class-completion