ctxora 6.2.2 → 6.3.0

package/src/harness_context/skills/ecc/homelab-network-setup/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: homelab-network-setup
+description: Practical home and homelab network planning for gateways, switches, access points, IP ranges, DHCP reservations, DNS, cabling, and common beginner mistakes. Use when planning or fixing a home or homelab network — gateway, switch, AP, IP ranges, DHCP, DNS, or cabling.
+metadata:
+  origin: community
+---
+
+# Homelab Network Setup
+
+Use this skill to design a home or small-lab network that can grow without
+needing a full rebuild.
+
+## When to Use
+
+- Planning a new home network or redesigning an ISP-router-only setup.
+- Choosing gateway, switch, and access point roles.
+- Designing IP ranges, DHCP scopes, static reservations, and DNS.
+- Preparing for future VLANs, Pi-hole, NAS, lab servers, or VPN access.
+- Troubleshooting a new network that has double NAT, unstable Wi-Fi, or changing
+  server addresses.
+
+## How It Works
+
+Start by separating device roles:
+
+```text
+Internet
+  |
+Modem or ONT
+  |
+Gateway or router      NAT, firewall, DHCP, DNS, inter-VLAN routing
+  |
+Managed switch         wired clients, AP uplinks, optional VLAN trunks
+  |
+Access points          Wi-Fi only; ideally wired backhaul
+Servers and NAS        stable addresses, DNS names, monitoring
+Clients and IoT        DHCP pools, isolated later if VLANs are available
+```
+
+Pick a gateway that matches the operator, not just the feature checklist:
+
+| Option | Best fit | Notes |
+| --- | --- | --- |
+| ISP router | Basic internet only | Limited control and often poor VLAN support |
+| UniFi gateway | Managed home network | Good UI, ecosystem lock-in |
+| OPNsense or pfSense | Flexible homelab | Strong VLAN, firewall, VPN, and DNS control |
+| MikroTik | Advanced network users | Powerful, but easy to misconfigure |
+| Linux router | Tinkerers | Document rollback before using as primary gateway |
+
+## IP Plan
+
+Avoid the most common default, `192.168.1.0/24`, when you expect to use VPNs.
+It often conflicts with hotels, offices, and ISP routers.
+
+```text
+Example small homelab plan:
+
+192.168.10.0/24  trusted clients
+192.168.20.0/24  IoT and media devices
+192.168.30.0/24  servers and NAS
+192.168.40.0/24  guest Wi-Fi
+192.168.99.0/24  network management
+
+Gateway convention: .1
+Infrastructure reservations: .2 through .49
+Dynamic DHCP pool: .50 through .240
+Spare room: .241 through .254
+```
+
+Use `home.arpa` for local names. It is reserved for home networks and avoids the
+leakage/conflict problems of ad hoc names like `home.lan`.
+
+```text
+nas.home.arpa
+pihole.home.arpa
+gateway.home.arpa
+switch-01.home.arpa
+```
+
+## DHCP And DNS
+
+- Use DHCP reservations for anything you SSH into, bookmark, monitor, or expose
+  as a service.
+- Hand out the gateway as DNS until a local resolver is intentionally deployed.
+- If using Pi-hole or another DNS filter, give it a reservation first, then point
+  DHCP DNS options at that address.
+- Keep a small static/reserved range per subnet so replacements do not collide
+  with dynamic leases.
+
+## Cabling And Wi-Fi
+
+- Prefer wired AP backhaul over mesh when you can run Ethernet.
+- Use a PoE switch for APs and cameras if the budget allows it.
+- Label both ends of each cable and keep a simple port map.
+- Put the gateway, switch, DNS server, and NAS on UPS power if outages are common.
+
+## Examples
+
+### Beginner Upgrade
+
+Goal: Keep the ISP router but stabilize a small lab.
+
+1. Set DHCP reservations for NAS, Pi, and any SSH hosts.
+2. Move local names to `home.arpa`.
+3. Disable duplicate DHCP servers on secondary routers or APs.
+4. Wire the main AP instead of relying on wireless backhaul.
+
+### VLAN-Ready Plan
+
+Goal: Prepare for future segmentation without enabling it immediately.
+
+1. Choose non-overlapping /24 ranges for trusted, IoT, servers, guest, and
+   management.
+2. Reserve .1 for the gateway and .2-.49 for infrastructure on every subnet.
+3. Buy a gateway and switch that support VLANs and inter-VLAN firewall rules.
+4. Document which SSIDs and switch ports will eventually map to each network.
+
+## Anti-Patterns
+
+- Double NAT without a reason or documentation.
+- Using `192.168.1.0/24` when VPN access is planned.
+- Dynamic addresses for NAS, Pi-hole, Home Assistant, or other service hosts.
+- Consumer routers repurposed as APs while their DHCP servers are still enabled.
+- Flat networks with cameras, smart plugs, laptops, and servers all sharing the
+  same trust boundary.
+
+## See Also
+
+- Skill: `network-interface-health`
+- Skill: `network-config-validation`

package/src/harness_context/skills/ecc/homelab-pihole-dns/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/harness_context/skills/ecc/homelab-pihole-dns/SKILL.md

@@ -0,0 +1,275 @@
+---
+name: homelab-pihole-dns
+description: Pi-hole installation, blocklist management, DNS-over-HTTPS setup, DHCP integration, local DNS records, and troubleshooting broken DNS resolution on a home network. Use when the task explicitly involves Pi-hole — installing it, managing blocklists, configuring DoH or DHCP, adding local DNS records, or diagnosing DNS resolution with Pi-hole in the path.
+metadata:
+  origin: community
+---
+
+# Homelab Pi-hole DNS
+
+Pi-hole is a network-wide DNS ad blocker that runs on a Raspberry Pi or any Linux host.
+Every device on your network gets ad and malware domain blocking automatically — no browser
+extension needed.
+
+## When to Use
+
+- Installing Pi-hole on a Raspberry Pi or Linux host
+- Configuring Pi-hole as the DNS server for a home network
+- Adding or managing blocklists
+- Setting up DNS-over-HTTPS (DoH) upstream resolvers
+- Creating local DNS records (e.g. `nas.home.lan`, `pi.home.lan`)
+- Troubleshooting devices that lose internet access after Pi-hole is installed
+- Running Pi-hole alongside or instead of DHCP
+
+## How Pi-hole Works
+
+```
+Normal flow (without Pi-hole):
+  Device → requests ads.tracker.com → ISP DNS → real IP → ads load
+
+With Pi-hole:
+  Device → requests ads.tracker.com → Pi-hole DNS → blocked (returns 0.0.0.0) → no ad
+
+All DNS queries go through Pi-hole first.
+Pi-hole checks against blocklists.
+Blocked domains return a null response — the ad/tracker never loads.
+Allowed domains get forwarded to your upstream resolver (Cloudflare, Google, etc.).
+```
+
+## Installation
+
+### Docker (Recommended)
+
+Docker is the easiest way to install Pi-hole and makes updates and backups
+straightforward.
+
+```yaml
+# docker-compose.yml
+services:
+  pihole:
+    image: pihole/pihole:<pinned-release-tag>
+    container_name: pihole
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "80:80/tcp"          # Web admin
+    environment:
+      TZ: "America/New_York"
+      WEBPASSWORD: "${PIHOLE_WEBPASSWORD}"   # set via .env file or secret
+      PIHOLE_DNS_: "1.1.1.1;1.0.0.1"
+      DNSMASQ_LISTENING: "all"
+    volumes:
+      - "./etc-pihole:/etc/pihole"
+      - "./etc-dnsmasq.d:/etc/dnsmasq.d"
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN              # only needed if Pi-hole will serve DHCP
+```
+
+Replace `<pinned-release-tag>` with a current Pi-hole release tag before deploying.
+Avoid `latest` for long-lived DNS infrastructure so upgrades are deliberate and
+reviewable.
+
+Set `PIHOLE_WEBPASSWORD` in a `.env` file next to `docker-compose.yml`, chmod it to
+`600`, and keep it out of git — do not put the password directly in the compose file.
+
+Access web admin at: `http://<pi-ip>/admin`
+
+### Bare-Metal Install (Raspberry Pi OS / Debian / Ubuntu)
+
+Pi-hole requires a static IP before installing.
+
+```bash
+# Step 1: Assign a static IP (edit /etc/dhcpcd.conf on Pi OS)
+sudo nano /etc/dhcpcd.conf
+# Add at the bottom:
+interface eth0
+static ip_address=192.168.3.2/24
+static routers=192.168.3.1
+static domain_name_servers=192.168.3.1
+
+# Step 2: Download and inspect the installer before running it.
+# Prefer the package or installer path documented by Pi-hole for your OS/version.
+curl -sSL https://install.pi-hole.net -o pi-hole-install.sh
+less pi-hole-install.sh   # review before proceeding
+
+# Step 3: Run
+bash pi-hole-install.sh
+
+# Follow the interactive installer:
+# 1. Select network interface (eth0 for wired — recommended)
+# 2. Select upstream DNS (Cloudflare or leave default — can change later)
+# 3. Confirm static IP
+# 4. Install the web admin interface (recommended)
+# 5. Note the admin password shown at the end
+```
+
+## Pointing Your Network at Pi-hole
+
+```
+# Method 1: Change DNS in your router DHCP settings (recommended)
+  Router admin UI → DHCP Settings → DNS Server
+  Primary DNS: 192.168.3.2  (Pi-hole IP)
+  Secondary DNS: leave blank for strict blocking, or use a second Pi-hole.
+                 A public fallback such as 1.1.1.1 improves availability during
+                 rollout but can bypass blocking because clients may query it.
+
+  All devices get Pi-hole as DNS automatically on next DHCP renewal.
+  Force renewal: reconnect Wi-Fi or run 'sudo dhclient -r && sudo dhclient' on Linux
+
+# Method 2: Per-device DNS (useful for testing before network-wide rollout)
+  Windows: Control Panel → Network Adapter → IPv4 Properties → set DNS manually
+  macOS: System Settings → Network → Details → DNS → set manually
+  Linux: /etc/resolv.conf or NetworkManager
+
+# Method 3: Pi-hole as DHCP server (replaces router DHCP)
+  Pi-hole admin → Settings → DHCP → Enable
+  Disable DHCP on your router first — two DHCP servers on the same network cause conflicts
+  Advantage: hostname resolution works automatically (devices register their names)
+```
+
+## Blocklist Management
+
+```
+# Pi-hole admin → Adlists → Add new adlist
+
+# Recommended blocklists:
+  https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
+  # default — 200k+ domains
+
+  https://blocklistproject.github.io/Lists/malware.txt
+  # malware domains
+
+  https://blocklistproject.github.io/Lists/tracking.txt
+  # tracking/telemetry
+
+# After adding a list:
+  Tools → Update Gravity  (downloads and compiles all blocklists)
+
+# If a site is blocked that should not be (false positive):
+  Pi-hole admin → Whitelist → Add domain
+  Example: api.my-legitimate-service.com
+
+# Check what is being blocked in real time:
+  Dashboard → Query Log  (live DNS query stream with block/allow status)
+```
+
+## DNS-over-HTTPS Upstream
+
+DNS-over-HTTPS encrypts your DNS queries so your ISP cannot see what sites you resolve.
+
+```bash
+# Install cloudflared (Cloudflare's DoH proxy).
+# Prefer Cloudflare's package repository for automatic signed package verification.
+# If you download a binary directly, pin a release version and verify its checksum.
+CLOUDFLARED_VERSION="<pinned-version>"
+curl -LO "https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64"
+# Verify the checksum/signature from Cloudflare's release notes before installing.
+sudo mv cloudflared-linux-arm64 /usr/local/bin/cloudflared
+sudo chmod +x /usr/local/bin/cloudflared
+
+# Create cloudflared config
+sudo mkdir -p /etc/cloudflared
+sudo tee /etc/cloudflared/config.yml << EOF
+proxy-dns: true
+proxy-dns-port: 5053
+proxy-dns-upstream:
+  - https://1.1.1.1/dns-query
+  - https://1.0.0.1/dns-query
+EOF
+
+# Create systemd service
+sudo cloudflared service install
+sudo systemctl start cloudflared
+sudo systemctl enable cloudflared
+
+# Now point Pi-hole at the local DoH proxy:
+# Pi-hole admin → Settings → DNS → Custom upstream DNS
+# Set to: 127.0.0.1#5053
+# Uncheck all other upstream resolvers
+```
+
+## Local DNS Records
+
+Make your services reachable by name (e.g. `nas.home.lan`, `grafana.home.lan`).
+
+> **Domain name note:** `.home.lan` is widely used in homelabs and works in practice.
+> The IETF-reserved suffix for local use is `.home.arpa` (RFC 8375) — use that to
+> follow the standard. Avoid `.local` for Pi-hole DNS records as it conflicts with
+> mDNS/Bonjour.
+
+```
+# Pi-hole admin → Local DNS → DNS Records
+
+  Domain              IP
+  nas.home.lan        192.168.30.10
+  pi.home.lan         192.168.30.2
+  grafana.home.lan    192.168.30.3
+  proxmox.home.lan    192.168.30.4
+
+# From any device on your network:
+  ping nas.home.lan        → 192.168.30.10
+  http://grafana.home.lan  → your Grafana dashboard
+
+# For subdomains, add a CNAME:
+  Pi-hole admin → Local DNS → CNAME Records
+  Domain: portainer.home.lan → Target: pi.home.lan
+```
+
+## Troubleshooting
+
+```bash
+# Pi-hole blocking something it should not
+pihole -q example.com          # Check if domain is blocked and which list
+pihole -w example.com          # Whitelist immediately
+
+# DNS not resolving at all
+pihole status                  # Check if pihole-FTL is running
+dig @192.168.3.2 google.com   # Test DNS directly against Pi-hole
+
+# Restart Pi-hole DNS
+pihole restartdns
+
+# Check query logs for a specific device
+pihole -t                      # Live tail of all queries
+# Or filter by client in the web admin Query Log
+
+# Pi-hole gravity update (refresh blocklists)
+pihole -g
+```
+
+## Anti-Patterns
+
+```
+# BAD: Depending on one Pi-hole without a recovery path
+# If Pi-hole crashes or the Pi loses power, DNS can stop working
+# GOOD: Keep a documented router fallback for rollback during setup
+# BETTER: Run two Pi-hole instances for redundancy; avoid public fallback DNS for strict blocking
+
+# BAD: Installing Pi-hole without a static IP
+# If the Pi gets a new DHCP IP, all devices lose DNS
+# GOOD: Set static IP first, then install Pi-hole
+
+# BAD: Enabling Pi-hole DHCP without disabling the router's DHCP first
+# Two DHCP servers on the same network hand out conflicting IPs
+# GOOD: Disable router DHCP, then enable Pi-hole DHCP
+
+# BAD: Never updating gravity (blocklists)
+# New ad and malware domains accumulate — stale lists miss them
+# GOOD: Schedule weekly gravity update: pihole -g (or enable in Settings → API)
+```
+
+## Best Practices
+
+- Give the Pi a static IP or DHCP reservation before installing Pi-hole
+- Use Pi-hole as primary DNS; for redundancy, add a second Pi-hole instead of a
+  public resolver if you need strict blocking
+- Enable DoH (DNS-over-HTTPS) with cloudflared for encrypted upstream queries
+- Set `home.lan` as your local domain and create DNS records for all your services
+- Review the Query Log occasionally — blocked queries show you what devices are doing
+
+## Related Skills
+
+- homelab-network-setup
+- homelab-vlan-segmentation
+- homelab-wireguard-vpn

package/src/harness_context/skills/ecc/homelab-vlan-segmentation/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.