| 2026-09-30 21:26:27 | qBittorrent watch-folder + auto-extract + library move | Media server 10.1.20.65. Samba share TorrentWatch (guest, rw) -> /home/ntadmin/media/torrents/watch (subfolders movies, tv). qBittorrent watch folders set via API: /data/torrents/watch -> /data/torrents, watch/movies -> /data/torrents/movies, watch/tv -> /data/torrents/tv (also in config/qBittorrent/watched_folders.json). On-finish hook replaced with: python3 /config/postprocess.py (host: /home/ntadmin/stacks/arr-stack/config/qbittorrent/postprocess.py, log postprocess.log) which keeps the existing Home Assistant webhook, extracts rar/zip/7z (unrar/7z/unzip already in container), moves extracted movies to /data/movies// and TV to /data/tv/<Show>/Season NN/, hardlinks loose video so seeding continues. Tested with fake zip/loose/TV downloads and a real tiny torrent in the watch folder; all test files removed. Jellyfin library (/media/movies) used as media server (no Plex present). Samba installed (apt); smb.conf backup smb.conf.pre-torrentwatch. No new credentials created.</td></tr>
<tr><td><strong>2026-09-30 21:28:03</strong></td><td>Samba account for TorrentWatch share</td><td>Created Linux nologin user + Samba account ‘torrentwatch’ on media server 10.1.20.65 for share \\10.1.20.65\TorrentWatch (/home/ntadmin/media/torrents/watch), because Windows 11 blocks guest SMB. Random 20-char password generated; stored in Vaultwarden as ‘Samba – torrentwatch (TorrentWatch share)’ (username torrentwatch, URI smb://10.1.20.65/TorrentWatch). Authenticated smbclient test OK. Guest access still enabled on the share.</td></tr>
<tr><td><strong>2026-09-30 21:28:55</strong></td><td>TorrentWatch Samba account changed to tw</td><td>Per user request: created Samba account ‘tw’ (Linux nologin user) on media server 10.1.20.65 for \\10.1.20.65\TorrentWatch with a user-supplied password; removed Samba/Linux user ‘torrentwatch’. Vaultwarden entry renamed/updated to ‘Samba – tw (TorrentWatch share)’ (username tw, URI smb://10.1.20.65/TorrentWatch). Authenticated smbclient test OK. Guest access remains enabled on the share (map to guest = Bad User).</td></tr>
<tr><td><strong>2026-09-30 21:36:23</strong></td><td>Home Assistant Apple TV / TV audit</td><td>Audited Home Assistant (10.1.20.169, HA 2026.9.3) device/entity registry via websocket using token from Vaultwarden. Apple TV 4K (apple_tv integration, tvOS 26.6, area Living Room): media_player.living_room_living_room, remote.living_room_living_room, binary_sensor.living_room_living_room_keyboard_focus. Renamed that device to ‘Living Room Apple TV’ (name_by_user; entity IDs unchanged). Set area Living Room on UniFi tracker device ‘AppleTV’ (device_tracker.appletv, 10.1.40.105). TV already present in HA: TCL Q5K via androidtv_remote (media_player/remote.living_room_tcl_living_room_tv), homekit_controller (media_player.living_room_tv_television, source Apple TV), music_assistant; Cast version disabled by user (left as is). media_player.living_room (Music Assistant Apple TV 4K) is unavailable. No credentials created.</td></tr>
<tr><td><strong>2026-09-30 21:42:56</strong></td><td>Home Assistant / network audit (read-only)</td><td>Read-only audit of HA 2026.9.3 (10.1.20.169, UI on port 80) via REST/websocket with token from Vaultwarden, plus UniFi client list and reachability tests from Deathstar, docker01 and media server. Findings: HA reachable from VLAN 10 and 20 (port 80), qBittorrent webhook reachable (HTTP 405 on GET); UniFi entry ‘ITTechSTL—UDM-Pro’ not_loaded (duplicate of loaded ‘Default’); WLED Dig-Octa 10.1.40.107 setup_retry/offline; Zmodo + CloudEdge cameras and Alexa Echo Dot entities unavailable; configuration.yaml has duplicate rest_command key (lines 12 and 34) so rest_command.n8n_trigger is missing and automation.qbittorrent_download_complete errors on its n8n Jellyfin/Plex refresh step; HA update 2026.9.4 pending; 21 Spook repair warnings; Plex server found at 10.1.20.10:32400. Also verified qBittorrent post-process script on three real downloads (Futurama S11E10, Last Week Tonight S13E24, Little Shop of Horrors 1986) and moved its HA webhook to fire after files are placed. No changes made to HA, UniFi or credentials in this audit.</td></tr>
<tr><td><strong>2026-09-30 21:45:11</strong></td><td>Firewall audit and VLAN 40 SIP/RTP rules</td><td>Audited UDM firewall (10.1.10.1): legacy mode, no zones/policies, only 2 IPS drop rules, no switch ACLs, all VLANs unisolated -> no inter-VLAN blocking. docker01 ufw (default deny in): added UDP 5060 and 10000:20000 from 10.1.40.0/24 (comment ‘VLAN40 softphones (phones)’) so iPhone/Pixel softphones can reach Asterisk; removed temporary rule UDP 69 from 10.1.10.10. Existing: SIP/RTP from 10.1.10.0/24 and 10.1.60.0/24, TFTP from 10.1.60.0/24, Zabbix agent from 10.1.20.17. Docker-published ports on docker01 bypass ufw. Media server has no host firewall. Reachability from VLAN 10 workstation: 17 of 18 services OK; Homepage https://10.1.20.18:8443 fails because Caddyfile (modified Sep 30 14:23) no longer has an 8443 site block (not a firewall issue). Cleanup: stopped temporary python TFTP server on Deathstar and removed extra IP 10.1.10.167. No credentials created.</td></tr>
<tr><td><strong>2026-09-30 21:50:20</strong></td><td>Firewall review, access check, Ollama restart</td><td>Full firewall/access review (read-only except noted): UDM legacy mode, no inter-VLAN rules, IPS disabled, no port forwards, WG server on, switches no ACL/port security; docker01 ufw default-deny with Docker ports bypassing it and SSH password auth on, fail2ban inactive; media server no host firewall; Deathstar Windows Firewall off on all profiles (RDP/SMB/WinRM/MeshCentral listening). Traffic verified from VLAN 10: 17/18 service ports OK (Homepage 8443 fails – Caddyfile lost its 8443 block), DNS OK, NTP to AD1 OK, SIP register+echo call OK (100/100 RTP), TFTP from VLAN 10 correctly blocked; syslog UDP 1514 did not reach Loki (promtail syslog is TCP-only). Changes: ufw on docker01 added SIP/RTP for 10.1.40.0/24, removed temp TFTP rule for 10.1.10.10; stopped temp TFTP server and removed 10.1.10.167 on Deathstar. Access check: SSH+sudo OK to docker01, media server, XCP-ng, zabbix01, HA (core-ssh); APIs OK for HA, UDM, Zabbix, Xen Orchestra; no access to 10.1.20.25, 10.1.20.20, HV2/AD1 (Windows), Raspberry Pi offline. HA configuration.yaml has duplicate rest_command keys (lines 13 and 35); not yet edited. Started Deathstar docker container ‘ollama’ (v0.34.4, RTX 4070 SUPER, models qwen2.5-coder:7b + nomic-embed-text, reachable from docker01). Vault directive check: all credentials created/used this session are in Vaultwarden (UniFi antigrav/googleapi, Asterisk ext 100/101, HA MCP token, Samba tw); no API users created.</td></tr>
<tr><td><strong>2026-09-30 22:32:09</strong></td><td>Updates applied across servers (HA, zabbix01, media, docker01)</td><td>Safety nets: XO snapshots ‘pre-update-2026-09-30’ on docker01 and zabbix01 (success), HA backup ‘pre-core-2026.9.4-claude’ slug e9ada361 (config, no DB), file backup /home/ntadmin/backups/pre-update-20260930.tgz on docker01 (vaultwarden data, Caddyfile, asterisk etc, homepage). Applied: Home Assistant core 2026.9.3 -> 2026.9.4 (verified 39 integrations loaded, 28 automations, rest_command fix intact). zabbix01: apt full-upgrade, kernel 6.8.0-146, rebooted; hung zabbix-server (needrestart) force-stopped; all services OK. Media server: apt full-upgrade incl docker 29.8.2 and kernel 6.8.0-146, rebooted; image updates (qBittorrent 5.2.4 with watch folders + postprocess hook intact, prowlarr/radarr/jellyfin current); 1 phased package remains. docker01: full-upgrade (docker 29.8.2, openssl, kernel 6.8.0-146), compose pull+up on all stacks, rebooted; iso_nfs restart policy set to unless-stopped; verified Caddy sites, Homepage login, Authentik, Grafana, Asterisk 22.10.1 rebuilt image with live SIP register + echo call (100/100 RTP). Not applied: Windows hosts HV2/AD1 and Deathstar (no access / not restarting the working PC), XCP-ng (0 pending), UniFi devices (already current), Authentik left pinned at 2024.8.2, containers without compose (signal-cli-rest-api on media, iso_nfs) not recreated. UniFi firewall stage 1 rules (S1 Block Guest/VoIP/iSCSI to private; S1 Allow VoIP to Asterisk) created at rule index 20010-20201 plus group RFC1918-PRIVATE; rollback ids in scratchpad fw_stage1_ids.json. Caddy: added homepage.ittechstl.local site with basic auth (hash made from vault password); caddy restarted to re-read file; Caddyfile backups kept. HA configuration.yaml duplicate rest_command merged (backup configuration.yaml.bak-pre-restmerge-20260930). No new credentials created.</td></tr>
<tr><td><strong>2026-09-30 23:18:50</strong></td><td>Movie share, Jellyfin libraries, IPTV guide</td><td>Mounted Windows share //10.1.20.10/mediashare (account hv1\media, credentials in root-only /root/.smbcred-hv, vault entry ‘Windows SMB – media share on 10.1.20.10 (hv1\media)’) at /mnt/mediashare on media server via fstab (cifs, automount, nofail). Movies library = /mnt/mediashare/Movies (83 release-named folders, 810 GB free). qBittorrent compose mounts it at /mediashare; postprocess.py now places finished movies in /mediashare/Movies/<release name>/ (copy across filesystems, 10 GB free-space guard); TV stays local /home/ntadmin/media/tv. Tested with a fake zip download (removed afterwards); copied existing ‘Little Shop of Horrors’ download to the share. Jellyfin (compose mounts share read-only at /mediashare): Movies library repointed to /mediashare/Movies with internet metadata enabled, new Shows library at /media/tv, library scan at startup + hourly (config/config/ScheduledTasks), backups: config-backup-pre-share.tgz, compose.yaml.bak-pre-share, docker-compose.yml.bak-pre-share. Scan result: 62 movies recognised of 83 folders (17 folders hold only .nfo, 2 empty, 2 RAR sets), 2 TV episodes. Live TV: existing M3U tuner (51 channels) + new XMLTV listing provider /config/epg/guide.xml built by /home/ntadmin/stacks/jellyfin/epg_build.py from iptv-epg.org (40/51 channels matched, ~6200 listings/7 days), systemd timer epg-refresh.timer daily 01:30, RefreshGuide task at startup + 02:30; 4394 listings loaded for 30 channels at last check. IPTV playlist account stored in vault as ‘IPTV – tv123.me M3U playlist (Jellyfin Live TV)’. File tv.m3u (78 channels, same provider) is on mediashare root. Not browsed: shares piz/LocalMedia.</td></tr>
<tr><td><strong>2026-10-01 01:16:30</strong></td><td>Built PSA/RMM Docker dev stack</td><td>Created C:\Users\jtanner\dev-stack: docker-compose.yml (postgres timescaledb pg17 127.0.0.1:5432, valkey 8 :6379, api FastAPI :8000, worker ARQ, web React/Vite/TS :5173, adminer :8081 tools profile), api/ (FastAPI, SQLAlchemy async, Alembic 0001 with device_metrics hypertable, JWT auth, tickets/customers/devices/agent check-in/SSE events), web/ (Vite+React+Tailwind+TanStack), .vscode config, README. Verified end-to-end with a throwaway test env; test containers, volumes and secrets removed. No real credentials created; user fills .env.</td></tr>
<tr><td><strong>2026-10-01 01:22:02</strong></td><td>Built deployable psa-rmm Docker image</td><td>In C:\Users\jtanner\dev-stack: added Dockerfile (multi-stage: node22 builds React UI, python3.13 slim runs FastAPI, non-root user app), api/entrypoint.sh (roles init/api/worker, runs alembic + seed), api/app/bootstrap.py (first-run secret generation into a secrets volume), SPA static serving in api/app/main.py, docker-compose.prod.yml (init, timescaledb pg17, valkey 8, api on port 8088, worker; no .env required), web build script now tsc –noEmit && vite build. Built local image psa-rmm:latest (649MB). Tested on a throwaway stack: login, /auth/me, UI deep links, restart persistence, worker cron OK; stack and volumes removed. Exported release/psa-rmm-latest.tar.gz (~150MB) plus release/docker-compose.yml. Nothing pushed to any registry. Admin password is generated at first run on the target host and not stored by the agent.</td></tr>
<tr><td><strong>2026-10-01 01:24:23</strong></td><td>Wrote PSA/RMM developer guide</td><td>Created C:\Users\jtanner\dev-stack\docs\DEVELOPMENT.md: architecture, repo layout, data model, API reference, config variables, dev workflow, feature walkthrough, VS Code setup, production image/deploy, security notes, gotchas, roadmap. Documentation only; no services or credentials changed.</td></tr>
<tr><td><strong>2026-10-01 02:49:44</strong></td><td>HA: spoken notifications silenced 7 PM-7 AM</td><td>Home Assistant 10.1.20.169: created helper input_boolean.voice_quiet_hours (on) and wrapped every spoken action (notify.alexa_media_*, tts.speak, media_player.play_media) in 15 automations with condition {{ is_state(‘input_boolean.voice_quiet_hours’,’off’) or (7 <= now().hour < 19) }}. Patched: Internet down alert, Announce someone at the door, New device on network, qBittorrent download complete, Fan schedule, Printer offline alert, RingCentral voicemail and missed call alert, Speaker offline alert, Bedtime announcement, Phone charge reminder, Phone not charging at 9 PM, Good morning with news, Cat litter reminder, Bills due this week, Zabbix critical infrastructure alert. Phone push (11) and persistent notifications (12) unchanged. Scripts good_night and qwen_voice_status left as-is (user-invoked). Verified rule at sample hours and that 27 spoken actions are guarded, 0 unguarded. Backup: /config/automations.yaml.bak-pre-quiet-hours. No credentials created.</td></tr>
<tr><td><strong>2026-10-01 15:10:32</strong></td><td>XCP-ng network review (read-only)</td><td>Read-only review of XCP-ng host XCPNG-R710-01 (10.1.20.9) networking + SW-CORE-01 ports (from saved UniFi snapshot; vault was locked). Findings: bond0 = eth0+eth1 OVS active-backup (no LACP), mgmt 10.1.20.9 on VLAN 20; eth0 is on SW-CORE-01 port 15 (label says NIC2) and eth1 on port 17 (label NIC1) – labels swapped; eth3 carries tagged VLAN 99 (iSCSI A, 10.1.99.11) on port 19 whose native VLAN is INT_Servers; eth2 (iSCSI B, 10.1.98.11) link up but no traffic seen and likely on spare port 21 (INT_Unused/VLAN 30); EqualLogic CTRLA port 24 negotiated only 100 Mbps; single iSCSI session 10.1.99.100 no multipath; MTU 1500 everywhere, UniFi jumbo off; iDRAC 10.1.10.6 sits on port 11 whose native VLAN is INT_Servers (VLAN 20) and link is down; host iptables INPUT policy ACCEPT with ports 22/80/443/111/5900/9500/10050/10809 listening; DNS 10.1.20.1 then AD1, NTP uses odd public servers; SMB SR XCP_LocalStorage (HV2 \\10.1.20.10\data) detached; my two XO snapshots (pre-update-2026-09-30) on docker01 and zabbix01 still present. No changes made.</td></tr>
<tr><td><strong>2026-10-01 19:10:21</strong></td><td>Cleanup of session leftovers</td><td>Removed: XCP-ng snapshots of docker01 and zabbix01 (made 2026-10-01 03:09Z before updates; services verified healthy; all 6 VMs still running, 0 snapshots left; SR space frees after coalesce); docker01 TFTP provisioning configs 000000000000.cfg, 0004f2be8d0d.cfg, 805e0c40a3d6.cfg (two contained ext 100 password in plain text); docker01 /opt/stacks/vaultwarden/Caddyfile.bak-attempt-ip8443 and temp captures/files in /tmp; Deathstar scratchpad tftproot (138 MB firmware copies) and pip package tftpy. Kept on purpose: /home/ntadmin/backups/pre-update-20260930.tgz on docker01 (Vaultwarden data + asterisk etc), HA backup pre-core-2026.9.4-claude (800 MB), config/compose backups (HA configuration.yaml.bak-pre-restmerge-20260930, automations.yaml.bak-pre-quiet-hours, Caddyfile.bak-pre-homepage-20260930, Jellyfin config-backup-pre-share.tgz and compose/docker-compose .bak-pre-share), TFTP container + Yealink/Polycom firmware ROMs and ufw rules for phones, DHCP option 66 on VLAN 60, UniFi stage 1 firewall rules (rollback ids in scratchpad fw_stage1_ids.json), media-share mount and /root/.smbcred-hv. No credentials created.</td></tr>
<tr><td><strong>2026-10-01 19:24:19</strong></td><td>WordPress plugins installed and configured (phase 1)</td><td>docker01 WordPress (wp.ittechstl.local, WP 7.1.2). DB backup first: /home/ntadmin/backups/wordpress-db-pre-plugins-*.sql. WP-CLI 2.12 added in container (/usr/local/bin/wp, ephemeral); fixed root-owned wp-content/upgrade + plugin files. Installed+activated: advanced-custom-fields 6.8.10, custom-post-type-ui 1.19.3, relevanssi 4.28.4 (index 1622 rows), fluent-smtp 2.4.1, daggerhart-openid-connect-generic 3.11.3, easy-table-of-contents 2.0.88; updated wordfence to 9.0.2. Deactivated (not deleted): seo-by-rank-math, cache-enabler. Settings: admin_email + Wordfence alertEmails = jeff.tanner@ittechstl.com, Wordfence howGetIPs=HTTP_X_FORWARDED_FOR trusted proxies 172.16.0.0/12, comments closed (default + existing), WP_POST_REVISIONS=5, new custom post type ops_log (REST /wp-json/wp/v2/ops-log) with ACF group ‘Ops Log details’ (host, service, severity, change_type, outcome, reference), categories Network/Voice/Smart Home/Media/Security/Storage/Servers/WordPress, TOC auto-insert, first entry id 78. UpdraftPlus schedule set daily (db 02:00 keep 14, files 02:30 keep 7, report email) – remote storage NOT yet set (TrueNAS 10.1.20.192, SSH off; needs API key). FluentSMTP configured to relay 10.1.20.18:25 as notify@ittechstl.com; relay accepts but Office 365 login rejects (535 5.7.3), ISP blocks port 25 to Microsoft; user chose Gmail relay (needs Google app password). Findings: log_action.ps1 has the antigravity account password hardcoded and posts via Basic-Auth plugin to page 9; HA wordpress_log posts to http://10.1.20.18:8080 with an application password. No credentials created in this phase.</td></tr>
<tr><td><strong>2026-10-02 00:50:19</strong></td><td>UniFi MCP login fix + IDS enabled</td><td>Set user env UNIFI_NETWORK_USERNAME=antigrav and UNIFI_NETWORK_PASSWORD from Vaultwarden entry ‘UniFi – antigrav (Super Admin)’ (previously claude/old pw, Forbidden). On UDM Pro 10.1.10.1 set ips setting: ips_mode=ids (detect-only), advanced_filtering_preference=manual, 14 categories (botcc, ciarmy, compromised, dshield, tor, emerging-dns/dos/exploit/malware/p2p/scan/shellcode/sql/worm), enabled on Workstation, IoT, Servers, VoIP, Guest, MGMT networks; iSCSI-A/B and Unused excluded. Hit login rate limit (429) during probing; cleared.</td></tr>
<tr><td><strong>2026-10-02 01:46:42</strong></td><td>Virtual host vs switch network audit (read-only)</td><td>Read-only audit, no config changes. XCP-ng 10.1.20.9 via SSH (xe/ovs-vsctl/ethtool): bond0 eth0+eth1 active-backup on NET-SERVERS-VLAN20, eth2 iSCSI-B 10.1.98.11 untagged, eth3 VLAN99 10.1.99.11 tagged; 6 VMs incl TrueNAS 10.1.20.192. UDM API (antigrav pw from Vaultwarden) read SW-CORE-01/SW-OFC-01 port overrides, networks, clients. Findings: ports 15/17/19 trunk all VLANs, port 19 native VLAN20 for iSCSI-A, port 9 iSCSI-A allows tagged VLANs, EqualLogic ports 5/7/23 link at 100Mbps, HV2 single NIC port 13 and iSCSI A only, no jumbo, iDRAC port 11 VLAN20 vs IP 10.1.10.6, STP priority default. HV2 (10.1.20.10) not queryable: Kerberos name resolution failed, no explicit credential.</td></tr>
<tr><td><strong>2026-10-02 03:18:02</strong></td><td>EqualLogic PS4100 read-only config review</td><td>Logged into EqualLogic PS4100 (group STOREGRP1, member EQ1, mgmt IP 10.1.1.50) as grpadmin over SSH (legacy ssh-rsa/DH-group14-sha1 options required) and ran read-only show commands only: member, controllers, disks, eth, grpparams, volume iscsilun01 (show/access/connections/snapshot/schedule), chapuser, account, partner, pool, recentevents. No configuration changes made. Findings: single controller (slot 0 missing), PSU1 failed, FW V8.1.0, eth0/1/2 up at 100 Mbps (eth0 284 errors), no NTP/DNS/syslog/email, telnet/FTP/SSH-v1/HTTP enabled, volume access records include wildcard *.*.*.* with no CHAP, RW SNMP community set, no snapshot schedule on iscsilun01, snap reserve 5% with 0 avail. grpadmin credential supplied by user; Vaultwarden entry ‘EqualLogic PS4100 – grpadmin’ PENDING because vault is locked.</td></tr>
<tr><td><strong>2026-10-02 03:46:05</strong></td><td>TravelLog page + 15-min phone location logger</td><td>Created private WordPress page TravelLog (page ID 83, https://wp.ittechstl.local/travellog/). Deployed /home/ntadmin/travellog/travellog.py + 600-perm .env on docker01 (10.1.20.18) with cron */15 min: reads person.jeff from Home Assistant (10.1.20.169 API) and inserts a row (time, location, details) under TRAVEL_ENTRIES_START, newest first, cap 3000 rows; writes as WP user homeassistant (creds from Vaultwarden ‘WordPress – Home Assistant Logger’). Waze Travel Time integration attempted but Waze returns 403 Forbidden to HA, flow cancelled, nothing added; distance from home computed instead. Zones Columbia Farm and CSS-STL Office not yet created (need coordinates).</td></tr>
<tr><td><strong>2026-10-02 04:24:38</strong></td><td>EqualLogic PS4100 hardening + XCP-ng SAS card check</td><td>EqualLogic EQ1 (10.1.1.50, group STOREGRP1) changes via SSH as grpadmin: NTP servers set to 10.1.20.15,10.1.10.1; telnet disabled; FTP disabled; unencrypted web access (HTTP 80) disabled (GUI stays on https 3002/3003); session idle timeout enabled (30 min); SMTP server 10.1.20.18, email-from eql-eq1@ittechstl.local, email-list jeff.tanner@ittechstl.com, email-notify enabled (not yet test-verified); read-write SNMP community removed (read-only community and trap manager 10.1.1.15 kept); volume iscsilun01 snap-reserve 5% -> 15%; new snapshot schedule ‘daily-snap’ (daily 02:00, keep 14, read-only). DNS server list rejected by array (needs NAS cluster) – not set. NOT changed: crypto-legacy-protocols (needed for SSH/initiators), volume access records/CHAP, firmware, existing snapshots. Read-only hardware checks: XCP-ng R710 (10.1.20.9) has Dell 6Gbps SAS HBA (LSI SAS2008, 1028:1f1c, FW 07.15.08.00, 8 phys, no devices attached) in addition to PERC 6/i; hv2 (10.1.20.10) not reachable with current credentials (WMI access denied). grpadmin Vaultwarden entry still PENDING (vault locked).</td></tr>
<tr><td><strong>2026-10-02 08:08:39</strong></td><td>Deployed UrBackup server on docker01</td><td>UrBackup server v2.5.x (uroni/urbackup-server:latest, container ‘urbackup’, host networking, restart unless-stopped) on docker01 10.1.20.18. Stack /opt/stacks/urbackup/docker-compose.yml. Storage: new 500GiB XCP-ng VDI ‘docker01-urbackup’ (VDI e48d0d1a, hot-attached as xvdc, ext4 label URBACKUP, fstab UUID mount /srv/urbackup, backups in /srv/urbackup/backups, db in /srv/urbackup/db) so backups cannot fill the root disk (dockervm root was 100% full so not used). Ports: web 55414/tcp, 55413/tcp, 55415/tcp, discovery 35623/udp; ufw allows only 10.1.10.0/24 and 10.1.20.0/24. Admin user ‘admin’ created, password generated and stored in Vaultwarden entry ‘UrBackup – admin (docker01)’ (c6fa45f9). Anonymous access verified blocked, authenticated login verified. Added UrBackup tile to Homepage services.yaml (backup services.yaml.bak-urbackup-20261002). No clients installed yet.</td></tr>
<tr><td><strong>2026-10-02 08:22:14</strong></td><td>UrBackup client auto-installer created</td><td>Created C:\Users\jtanner\UrBackup\Install-UrBackupClient.ps1: unattended Windows UrBackup client installer run from the admin PC (local or remote via WinRM -ComputerName, -Force, -DownloadOnly). Reads admin password from Vaultwarden item ‘UrBackup – admin (docker01)’ (via legacy bw, needs BW_SESSION), logs in to UrBackup API on 10.1.20.18:55414, creates the client record (idempotent), downloads a per-machine NSIS installer with name/authkey/server baked in, runs it with /S, then waits for the client to show online. Server change: set Internet server to 10.1.20.18:55415 (general settings, verified no other settings changed) so installers work from any VLAN. Tested: login, new+existing client paths, installer validity (MZ, NSIS, stable key, name+IP embedded); the actual install on a target was NOT executed. Test clients autoinstall-probe, probe-a, probe-b, installer-selftest marked for deletion (pending server cleanup). Note: server auto-discovered an existing agent named HV2.</td></tr>
<tr><td><strong>2026-10-02 08:41:15</strong></td><td>UrBackup: installer published, AD1 enrolled + first backup, TrueNAS recon</td><td>1) Published installer files (Install-UrBackupClient.ps1/.cmd, README.txt; no secrets) to \\AD1\Deploy$\UrBackup (D:\Shares\Deploy\UrBackup), NTFS locked to Administrators/SYSTEM full + Users read-only (inheritance removed). 2) Fixed installer bugs: elevation check used IsInRole(‘Administrator’) string (wrong) -> WindowsBuiltInRole; Start-Process -Wait hung because installer spawns the tray app -> now waits on installer process only with 5 min timeout. 3) Installed UrBackup client 2.5.32 on AD1 (10.1.20.15, domain controller) via WinRM; service UrBackupClientBackend running, client id 5 online; removed leftover installer from AD1 temp. 4) AD1 backup job: defaults kept (files C:\ and D:\ with default excludes, incr every 5h, full every 30d, image C: weekly incr); changed per-client: image full every 30d, image backups only 22:00-06:00. First full file backup completed OK (14.7GB, 0 issues) to local /srv/urbackup. Image backup of C: scheduled in night window. 5) TrueNAS review (read-only, no login): VM on XCP-ng (4 vCPU/16GiB, SCALE 24.04.2 ISO still attached, 32GiB OS + 500GiB data disk both on Local storage SR), IP 10.1.20.192, web 80/443 only, DNS truenas.ittechstl.local -> 10.1.20.254 (stale, no reply), default self-signed cert. Needs TrueNAS credentials/API key for LUN work (not yet provided).</td></tr>
<tr><td><strong>2026-10-02 09:44:13</strong></td><td>TrueNAS VM: second NIC added (iSCSI-A); upgrade pending credentials</td><td>XCP-ng 10.1.20.9: hot-added VIF device 1 (MAC 9e:64:50:24:a5:b7, VIF 1148be7f) to TrueNAS VM (1acf30f2) on network ISCSI-FABRIC-A-VLAN99 (VLAN 99 tagged on physical eth3 -> SW-CORE-01 port 19). Existing VIF 0 (26:27:27:27:27:27) stays on NET-SERVERS-VLAN20 (bond eth0+eth1) with 10.1.20.192. TrueNAS still reachable. Guest side NOT configured (new NIC needs a static IP in 10.1.99.0/24 inside TrueNAS) and the SCALE 24.04.2 -> 25.10 upgrade (path 24.10 -> 25.04 -> 25.10, VM snapshot first) NOT started: no TrueNAS credentials/API key in Vaultwarden.</td></tr>
<tr><td><strong>2026-10-02 09:48:56</strong></td><td>docker01 mailrelay (Postfix) review and config</td><td>Located Postfix: container ‘mailrelay’ (boky/postfix) in /opt/stacks/mailrelay on docker01 (10.1.20.18), port 25, relayhost [smtp.office365.com]:587 auth as notify@ittechstl.com. Finding: M365 rejects the login (535 5.7.3) so 3 messages are stuck in queue since 2026-09-30; outbound tcp/25 is blocked by ISP (587 open); SPF for ittechstl.com already includes sendgrid.net. Changes: backed up compose.yml to compose.yml.bak-20261002; added 10.1.1.0/24 to POSTFIX_mynetworks (EqualLogic mgmt), set POSTFIX_inet_protocols=ipv4 (removes IPv6 unreachable noise), recreated container (healthy, queue preserved). EqualLogic email-from changed to notify@ittechstl.com so the relay’s ALLOWED_SENDER_DOMAINS accepts it. NOT fixed: M365 authentication (needs SMTP AUTH enabled for notify@ mailbox / basic auth is being retired, or switch to SendGrid API key or OAuth2). No passwords changed or displayed.</td></tr>
<tr><td><strong>2026-10-02 09:53:33</strong></td><td>XCP-ng NIC review and best-case network recommendation (read-only)</td><td>Reviewed XCP-ng 10.1.20.9: 4x Broadcom BCM5709 1GbE (eth0/eth1 on PCI 01:00.x, eth2/eth3 on 02:00.x), free PCIe slots PCI1(x8), PCI3, PCI4. bond0 = eth0+eth1 active-backup (both on the SAME controller) on VLAN20 carrying mgmt + all VMs; eth2 iSCSI-B untagged VLAN98 (port 21, correct); eth3 iSCSI-A VLAN99 tagged on trunk-all port 19 with native VLAN20; MTU 1500 everywhere, switch jumbo off; iDRAC port 11 link down, 10.1.10.6 unreachable; host has an open iSCSI session to EqualLogic iscsilun01 (10.1.99.100) although no SR uses it; TrueNAS VM now has vNICs on VLAN20 and iSCSI-A. Recommendation delivered: cross-controller pairing (bond eth0+eth2 LACP on ports 15+16, iSCSI-A eth1, iSCSI-B eth3), access ports/pruned VLANs, jumbo 9000 on iSCSI VLANs only, iDRAC on VLAN1 10.1.1.x, multipath for EQ SR. No changes made.</td></tr>
<tr><td><strong>2026-10-02 10:17:18</strong></td><td>Vaultwarden: EqualLogic grpadmin credential stored; TrueNAS lookup</td><td>Searched Vaultwarden for TrueNAS (by name and IP 10.1.20.192): no entry exists. Found existing entry ‘EqualLogic PS4100 EQ1 (grpadmin)’ with username but no password; updated it in place with the grpadmin password and added URI https://10.1.1.50 plus a note (rotate: password matches the UniFi antigrav password). No secrets written to files. Vault must be re-locked (bw lock) by the user.</td></tr>
<tr><td><strong>2026-10-02 10:29:09</strong></td><td>TrueNAS credentials verified and stored in Vaultwarden</td><td>Verified the admin login on TrueNAS SCALE 24.04.2 (VM ‘truenas’, 10.1.20.192) with a read-only API call GET /api/v2.0/system/info (HTTP 200). Created Vaultwarden entry ‘TrueNAS – admin (10.1.20.192)’ (username admin, URIs https://10.1.20.192 and https://truenas.ittechstl.local) with a note that the password is weak and should be changed. No TrueNAS configuration was changed. Temp files removed.</td></tr>
<tr><td><strong>2026-10-02 10:31:18</strong></td><td>TrueNAS API key created and stored in Vaultwarden</td><td>Created TrueNAS SCALE API key ‘claude-code’ (id 1, full allowlist) via POST /api/v2.0/api_key using the admin password fetched from Vaultwarden. Stored the key in Vaultwarden entry ‘TrueNAS – API key claude-code (10.1.20.192)’ (only copy). Verified: Bearer auth returns HTTP 200 on /system/version; a wrong key returns 401. Key was never printed or written to a file; temp files deleted. Also observed Conditional Access policy backup files created by the user’s run of ca_fix.ps1 (~15:21 UTC); mail relay queue flushed afterward.</td></tr>
<tr><td><strong>2026-10-03 10:14:20</strong></td><td>docker01 Caddy IP/8443 fix</td><td>Edited /opt/stacks/vaultwarden/Caddyfile on docker01 (backup: Caddyfile.bak-20261003): added global default_sni 10.1.20.18 so https://10.1.20.18 serves Vaultwarden instead of a TLS internal error, and added a 10.1.20.18:8443 site (basic_auth admin, reverse_proxy homepage:3000). Validated, reloaded caddy with no restart. Verified ip443=200, ip8443=401 (auth), vault.ittechstl.local=200.</td></tr>
<tr><td><strong>2026-10-03 10:29:38</strong></td><td>EQ1 stale snapshots deleted; Zabbix WP check fixed</td><td>EqualLogic PS4100 EQ1 (10.1.1.50): deleted snapshots iscsilun01-def-2026-05-27-00:00:01.140.1 and iscsilun01-def-2026-05-28-00:00:01.141.1 (offline, 0 connections). Group free space 653.24GB -> 2.18TB; iscsilun01 snapshot borrowed space 1.83TB -> 286.55GB. Zabbix (10.1.20.17): httptest 4 ‘WordPress Production’ step changed to https://10.1.20.18 with Host header wp.ittechstl.local (Zabbix server cannot resolve wp.ittechstl.local); problem cleared. docker01 Caddyfile earlier: default_sni + :8443 site. Read-only: dockervm root disk 100% full (media in /home/ntadmin/media, 44G), XCP-ng has no iSCSI SR, all 6 VMs on Local storage.</td></tr>
<tr><td><strong>2026-10-03 10:33:07</strong></td><td>XCP-ng: AD2-DC removed</td><td>XCP-ng host 10.1.20.9: shut down and deleted VM AD2-DC (uuid 431b1670-826a-4ecc-b4ee-b51b2b6a8b17, Windows Server 2022, 2 vCPU/2GB, 32GB disk ‘0’), deleted custom template AD2-DC (uuid 61b45f4b-b26a-86f0-ab40-768981e633e7) and orphaned 60GB VDI AD2-DC-OS (uuid 11d5ff5f-ae8a-4e05-8842-2129271e0d04). AD2-DC was not a domain controller (AD lists only AD1 10.1.20.15, all FSMO roles). Local storage used 1.42TB -> 1.33TB of 3.96TB. No Zabbix host existed for AD2-DC.</td></tr>
<tr><td><strong>2026-10-03 10:35:09</strong></td><td>dockervm root LV extended</td><td>dockervm (10.1.20.65): ran lvextend -r -l +100%FREE on /dev/ubuntu-vg/ubuntu-lv, using 62GB unallocated VG space; root fs grew from 61GB (100% full) to ~123GB. No data moved or deleted, containers untouched. Fixes Zabbix FS[/] triggers.</td></tr>
<tr><td><strong>2026-10-03 11:10:11</strong></td><td>HA: notifications reduced to critical only</td><td>Home Assistant (10.1.20.169): backed up all 28 automation configs (scratchpad ha_automations_backup_20261003.json). Turned OFF via automation.turn_off: qbittorrent_download_complete, new_device_on_network, printer_offline_alert, speaker_offline_alert, phone_battery_low_alert, phone_charge_reminder_echo, phone_not_charging_at_9_pm, front_door_camera_battery_below_40. Left ON as critical: internet_down_alert, zabbix_critical_infrastructure_alert (High/Disaster only). Pending Jeff’s decision: ringcentral voicemail, announce_someone_at_the_door, cat_litter, bills_due, daily_agenda, bedtime, good_morning, fan_schedule, presence_left_home.</td></tr>
<tr><td><strong>2026-10-03 11:46:58</strong></td><td>Lab OS HUD built; mcpo proxy; qwen3:14b pulled</td><td>Created C:\Users\jtanner\.agents\hud\ (collector.py, serve.py, index.html, d3.min.js, eq_cache.json): local force-directed lab graph at http://localhost:8200 (localhost-only, no auth). Nodes from UniFi (devices/clients), Zabbix (hosts/problems), XCP-ng (VMs/SRs), docker01+dockervm (containers), Home Assistant (domains/automations), EqualLogic (cached). Live data-flow animation from UniFi per-port/uplink/client throughput, refreshed every 4s; graph rebuilt every 90s. Secrets pulled from Vaultwarden at launch (BW_SESSION required); Zabbix read-only token used. Also: mcpo proxy on :8100 (mcpo 0.0.17 + mcp 1.13.1 pinned) exposing unifi-network, home-assistant, docker MCP servers; vault entry ‘mcpo – Open WebUI tool server API key’ created. qwen3:14b pulled into Ollama; old qwen2.5-coder:7b intentionally NOT removed yet (about 15 scripts and the HA Ollama entry still reference it).</td></tr>
<tr><td><strong>2026-10-03 12:03:46</strong></td><td>Ollama qwen3:14b swap, Open WebUI tools, HUD icons</td><td>Ollama (Deathstar docker): removed qwen2.5-coder:7b; qwen3:14b is the model. Container recreated with OLLAMA_NUM_PARALLEL=1, OLLAMA_KV_CACHE_TYPE=q8_0, FLASH_ATTENTION=1, KEEP_ALIVE=30m (was NUM_PARALLEL=4, which forced 31% CPU offload); now 100% GPU at 8192 ctx. Repointed to qwen3:14b with think=false (backups in session scratchpad qwen_swap_backup): .agents/jarvis/{jarvis_loop,governor,chat}.py, network-sentinel.ps1, jarvis_*.py, jarvis_engine.ps1, DOCKER_INVENTORY.md. Home Assistant Ollama conversation subentry ‘Qwen Local Brain’ switched to qwen3:14b via reconfigure flow (keep_alive -1 -> 1800s); verified with a live conversation call. Open WebUI (docker01:8081): onboarding was open, created admin admin@ittechstl.local (password in Vaultwarden entry ‘Open WebUI – admin’), added tool servers UniFi/Home Assistant/Docker via mcpo http://10.1.10.10:8100 (key in vault entry ‘mcpo – Open WebUI tool server API key’); verified native tool call. Lab HUD at http://localhost:8200 now uses Lucide icons (hud/icons) matched per device/service.</td></tr>
<tr><td><strong>2026-10-03 12:03:54</strong></td><td>Ollama qwen3:14b swap, Open WebUI tools, HUD icons</td><td>Ollama (Deathstar docker): removed qwen2.5-coder:7b; qwen3:14b is the model. Container recreated with OLLAMA_NUM_PARALLEL=1, OLLAMA_KV_CACHE_TYPE=q8_0, FLASH_ATTENTION=1, KEEP_ALIVE=30m (was NUM_PARALLEL=4, which forced 31% CPU offload); now 100% GPU at 8192 ctx. Repointed to qwen3:14b with think=false (backups in session scratchpad qwen_swap_backup): .agents/jarvis/jarvis_loop.py, governor.py, chat.py, network-sentinel.ps1, jarvis_*.py, jarvis_engine.ps1, DOCKER_INVENTORY.md. Home Assistant Ollama conversation subentry ‘Qwen Local Brain’ switched to qwen3:14b via reconfigure flow (keep_alive -1 -> 1800s); verified with a live conversation call. Open WebUI (docker01:8081): onboarding was open, created admin admin@ittechstl.local (password in Vaultwarden entry ‘Open WebUI – admin’), added tool servers UniFi/Home Assistant/Docker via mcpo http://10.1.10.10:8100 (key in vault entry ‘mcpo – Open WebUI tool server API key’); verified native tool call. Lab HUD at http://localhost:8200 now uses Lucide icons (hud/icons) matched per device/service.</td></tr>
<tr><td><strong>2026-10-03 12:12:58</strong></td><td>Local Jarvis voice stack</td><td>Deathstar Docker: started wyoming-whisper (:10300, faster-whisper small-int8 en), wyoming-piper (:10200, en_GB-alan-medium), wyoming-openwakeword (:10400, hey_jarvis); all restart=unless-stopped, volumes wyoming-whisper/piper/oww. Registered all three in Home Assistant (Wyoming integrations; entities stt.faster_whisper, tts.piper, wake_word.openwakeword). Created HA Assist pipeline ‘Jarvis (local)’ id 01m41c17tptmvws4hbb7wfq8bq (qwen3:14b brain, local STT/TTS, wake word hey_jarvis); NOT set as preferred. Found existing pipeline ‘Qwen Local AI (RTX 4070)’ uses Google STT/TTS (cloud). Verified text->qwen3->Piper audio end to end; real microphone STT not yet tested. Vault entry ‘Jarvis voice stack (Wyoming) – Deathstar’ created.</td></tr>
<tr><td><strong>2026-10-03 12:21:16</strong></td><td>JARVIS self-improvement with human approval</td><td>In C:\Users\jtanner\.agents\jarvis: new approvals.py (queue + audit; kinds tuning, prompt, hud_prompt, lesson; nothing applies without approval), lessons_job.py (feedback -> lesson proposals), hud_eval.py + eval_tasks.json (13 regex-checked tasks; –improve submits better HUD prompts for approval). Retrofitted coach.py (proposes tuning changes and reverts instead of applying; fixed bug that re-judged old experiments) and selfimprove.py (tournament winner is proposed, not adopted); backups in session scratchpad qwen_swap_backup. HUD (hud/serve.py + index.html): approvals panel with Approve/Reject, thumbs up/down + correction on every answer, interactions.jsonl and feedback.jsonl logging, approved lessons retrieved by embedding into chat context. POST endpoints require X-HUD header; server bound to 127.0.0.1. Baseline eval of current prompt: 100% (too easy to measure gains). JARVIS scheduled tasks remain Disabled; nothing scheduled by me.</td></tr>
<tr><td><strong>2026-10-03 12:45:01</strong></td><td>ITDocs WordPress plugin v0.1 (dev)</td><td>New project C:\ITTechSTL\WPProjects\itdocs (dev only, nothing deployed to production): docker compose project itdocs-dev on Deathstar – WordPress 7.1 :8088 (localhost only), MariaDB, vault service (dedicated KeePass KDBX, FastAPI+pykeepass, internal network only, no published port), wp-cli. Plugin ‘itdocs’ v0.1.0: organizations, assets, flexible assets+templates, documents, contacts, KeePass-backed credentials (reference only, audited reveal/copy), relationships, global search (Ctrl+K), expirations+email digest, review queue (agents can only propose), audit trail, REST API and inventory sync. Tests: 23/23 vault service, 75/75 plugin, 32/32 UI screens. tools/sync_itdocs.py proposed 20 lab devices (pending approval). Vaultwarden entries created: ITDocs DEV WordPress – admin; MariaDB itdocs and root; KeePass master password; KeePass key file (base64); vault-service API token; agent application password.</td></tr>
<tr><td><strong>2026-10-03 12:56:26</strong></td><td>Main WordPress site: About and Projects pages added</td><td>Production site https://wp.ittechstl.local (docker01, container wordpress-wordpress-1, Twenty Twenty-Five): backed up the database first to ~/backups/wp-before-content-20261003-175525.sql on docker01 (6.2 MB, 285 tables, mode 600). Added 10 PUBLISHED pages via a PHP script run in the container as www-data: About Jeff (/about-jeff/), Projects hub (/projects/, page 239) and 8 child pages /projects/{lab-network, virtualization-and-storage, jarvis, lab-os, itdocs, smart-home, home-server, monitoring} (pages 240-247; About is 248). Content is high level: no IP addresses, serial numbers, credentials or known weaknesses (scanned: 0 hits). Existing pages and posts (TravelLog #83, AI Action Log #9, posts) left untouched and verified unchanged. TravelLog and the YouTube idea were intentionally not included. Script is idempotent (re-run updates the same pages). Rollback: trash pages 239-248, or restore the SQL dump.</td></tr>
<tr><td><strong>2026-10-03 13:03:27</strong></td><td>WordPress ntadmin password reset</td><td>Main site https://wp.ittechstl.local (docker01): at Jeff’s request set a new password on the administrator account ntadmin (user ID 1) using wp_set_password inside container wordpress-wordpress-1 (password supplied over stdin, not on a command line). Verified: wp_check_password OK, a real wp-login.php POST returned 302 to /wp-admin/, and private page 83 (TravelLog) loaded when logged in. Stored in Vaultwarden as ‘WordPress – ntadmin (wp.ittechstl.local)’. No other accounts or settings changed. Note recorded: the chosen string is shared with another account.</td></tr>
<tr><td><strong>2026-10-03 13:11:05</strong></td><td>Main site: personalized dashboard and public site</td><td>Production https://wp.ittechstl.local (docker01, container wordpress-wordpress-1; files bind-mounted at /home/ntadmin/stacks/wordpress/wp_data). Fresh DB backup first: ~/backups/wp-before-dashboard-20261003-180601.sql (6.3 MB, 285 tables). 1) ADMIN DASHBOARD: new must-use plugin wp-content/mu-plugins/jeff-dashboard.php (no credentials; delete the file to undo): widgets Control room (greeting, links to site pages and lab tools), Latest logged actions (parsed from the AI Action Log page), Projects (status from the project pages), Where is Jeff (newest TravelLog row), Site and backup health (versions, pending updates, UpdraftPlus backup status); Quick Draft and WordPress News widgets hidden; ntadmin set to a 2-column layout. FINDING: UpdraftPlus is scheduled daily but has never recorded a backup and has no remote storage. Also pre-existing: Wordfence installation incomplete. 2) PUBLIC SITE: tagline set; new Home page (id 256) set as front page; new Updates page (id 255) set as posts page; header menu (wp_navigation id 6) now Home, Projects, About Jeff, Updates, Action Log; Additional CSS added (Appearance > Customize > Additional CSS); site icon (media id 260); footer template part (id 265) replaces placeholder links. Previous settings for undo: show_on_front=posts, page_on_front=0, page_for_posts=0, site_icon=0, blogdescription empty. Existing pages/posts, TravelLog (private) and Action Log content untouched; timezone setting left at UTC (widgets format in America/Chicago).</td></tr>
<tr><td><strong>2026-10-03 13:18:34</strong></td><td>Dashboard: Network resources widget</td><td>Production dashboard (https://wp.ittechstl.local/wp-admin): added widget ‘Network resources’ in a new right-hand (3rd) column via the existing mu-plugin wp-content/mu-plugins/jeff-dashboard.php; dashboard layout for ntadmin set to 3 columns. Data file wp-content/lab-resources.json (49 resources in 8 groups; 29 with a verified working link) is generated on Deathstar by C:\Users\jtanner\.agents\hud\export_resources.py (reads the lab graph + XCP-ng VM addresses + a curated service list, probes each address, links only where something answers, then copies the JSON into the wordpress container). Homepage entry uses fallback https://10.1.20.18:8443 because homepage.ittechstl.local does not resolve from Deathstar. Widget has a live filter box. The list is a snapshot: re-run export_resources.py to refresh. No credentials in the file.</td></tr>
<tr><td><strong>2026-10-03 14:38:58</strong></td><td>JARVIS Ollama Connection & Status Verification</td><td>Connected to local Ollama inference instance at http://10.1.10.10:11434. Verified GPU hardware RTX 4070 SUPER and models (qwen3:14b, nomic-embed-text:latest). Successfully tested JARVIS prompt and received live status report.</td></tr>
<tr><td><strong>2026-10-03 14:44:59</strong></td><td>Job Applying Bot Architecture & Core Engine Deployed</td><td>Engineered end-to-end Job Applying Bot located at C:\Users\jtanner\job-apply-bot. Configured Orchestrator, BaseATSPlugin architecture with auto-discovery, Greenhouse, Lever, and Workday plugins with ARIA locators, local Ollama LLM integration (qwen3:14b on RTX 4070 SUPER), SQLite telemetry schema (capturing screenshots and raw DOM dumps), CLI, and validated component test suite.</td></tr>
<tr><td><strong>2026-10-03 14:51:48</strong></td><td>Job Apply Bot – Dice.com & JARVIS Snag Resolver Integrated</td><td>Verified current resume (C:\Users\jtanner\Desktop\Jeff_Tanner_Resume.docx, updated Oct 2 2026) and generated C:\Users\jtanner\Desktop\Jeff_Tanner_Resume.pdf. Configured Vaultwarden credential auto-retrieval via bw-old. Implemented Dice.com ATS/portal plugin with automated login and persistent storageState. Built SnagResolver engine utilizing local Ollama (qwen3:14b on RTX 4070 SUPER) for autonomous error diagnosis, unblocking, and retries. Validated complete test suite.</td></tr>
<tr><td><strong>2026-10-03 14:59:43</strong></td><td>Job Apply Bot – Continuous Learning, Easy Apply & Clearance Filter Deployed</td><td>Thoroughly tested and verified complete Job Applying Bot stack. Successfully executed end-to-end browser automation flow with live snag injection, autonomous modal dismissal, and JARVIS Ollama form remediation (qwen3:14b on RTX 4070 SUPER). Deployed Continuous Learning Engine (core/memory.py) that automatically synthesizes, persists, and recalls proven fixes to avoid repeating mistakes. Enhanced Dice plugin with priority Easy Apply detection. Built security clearance pre-screening filter to automatically skip jobs requiring active Top Secret/Secret/Polygraph clearances. 100% test pass rate across 4 test suites.</td></tr>
<tr><td><strong>2026-10-03 15:02:56</strong></td><td>Job Apply Bot – Dynamic Resume Customization Engine Deployed</td><td>Engineered autonomous Resume Customization & Tailoring Engine (core/resume_customizer.py). When applying, the bot uses local Ollama (qwen3:14b on RTX 4070 SUPER) to analyze the job requirements, dynamically customize Jeff Tanner’s resume subtitle and professional summary to mirror the employer’s tech stack, and compile a bespoke PDF via Word COM. Automatically attaches this tailored PDF during application submission. Validated with comprehensive automated test suite (Ran in 15.3s, OK).</td></tr>
<tr><td><strong>2026-10-11 18:24:56</strong></td><td>Vaultwarden Inquiry</td><td>Retrieved and reported Vaultwarden server location and access details (docker01 @ 10.1.20.18).</td></tr>
<tr><td><strong>2026-10-12 23:56:51</strong></td><td>Zammad baseline configuration</td><td>On srv-msp-01 (10.1.20.50) via Rails runner in zammad-railsserver: set timezone_default=America/Chicago, system_init_done=true; created email address support@ittechstl.com; groups Support and Projects (existing: Users, Infrastructure Alerts); calendar ‘Business Hours (Central)’ Mon-Fri 08:00-17:00; SLA ‘Standard Support’ (first response 240m, update 480m, solution 960m, Support group); 5 text modules (ack, info, remote, done, after). No credentials created. Inbound email channel and Zammad->MSP Bridge webhook NOT configured (pending mailbox credentials and bridge header support).</td></tr>
<tr><td><strong>2026-10-12 23:59:36</strong></td><td>Tactical RMM baseline configuration</td><td>On srv-msp-01 (10.1.20.50) via Django shell in trmm-backend: set global default alert template to ‘Production Infrastructure Criticals’ (was unapplied); changed tacticaladmin email from admin@example.com to jeff.tanner@ittechstl.com; created policy ‘Client Baseline Policy’ (C: disk check warn 85%/err 95%) and applied it as server+workstation policy to 9 client orgs (all except ITTechSTL.dev). Existing: 10 clients, 2 agents (Deathstar, HV2 under ITTechSTL.dev), SMTP 10.1.20.18:25 notify@ittechstl.com. No credentials created.</td></tr>
<tr><td><strong>2026-10-13 00:27:09</strong></td><td>Authentik SSO server deployed and configured</td><td>Deployed Authentik 2026.8.3 on srv-msp-01 (10.1.20.50) at /opt/authentik (postgres, server, worker; no host ports; secrets in /opt/authentik/.env mode 600). Published via msp-edge-nginx at https://auth.ittechstl.com (nginx-edge.conf backed up as nginx-edge.conf.bak-*; runtime upstream resolution). DNS: A record auth.ittechstl.com -> 10.1.20.50 on 10.1.20.15. Authentik config: user jeff.tanner (superuser via ‘authentik Admins’, temp password), group ‘ITTechSTL Technicians’, MFA enrollment (TOTP/WebAuthn) forced in default login flow, brand title ‘IT Tech STL Sign-In’, OIDC providers+applications zammad, tactical-rmm, invoice-ninja, meshcentral. NOT done: app-side SSO wiring (self-signed wildcard cert not trusted by apps), Vaultwarden entries (bw old CLI create/import returns HTTP 422), Authentik DB backup. Vault CLI re-logged in (local cache reset).</td></tr>
<tr><td><strong>2026-10-13 00:37:58</strong></td><td>Authentik applications registered for network services</td><td>In Authentik (https://auth.ittechstl.com) created OIDC provider+application for: zammad, tactical-rmm, invoice-ninja, meshcentral, vaultwarden, jellyfin, home-assistant, wordpress (wp.ittechstl.local), xen-orchestra, nextcloud, wazuh, open-webui; SAML provider+application for zabbix (10.1.20.17). Authentik side only: app-side configuration still pending, blocked by self-signed *.ittechstl.com certificate not trusted by apps. No credentials created beyond earlier temp password for jeff.tanner.</td></tr>
<tr><td><strong>2026-10-13 01:03:45</strong></td><td>Let’s Encrypt wildcard cert + Zammad SAML SSO</td><td>srv-msp-01: issued Let’s Encrypt cert for ittechstl.com and *.ittechstl.com via certbot dns-cloudflare (token file /opt/msp-suite/certbot/cloudflare.ini mode 600, config /opt/msp-suite/certbot/le), installed over /etc/letsencrypt/live/ittechstl.com/*.pem (self-signed backup in /opt/msp-suite/certbot/backup), nginx reloaded, all 8 hostnames verified trusted; weekly renewal via /etc/cron.d/ittechstl-cert-renew -> /opt/msp-suite/certbot/renew.sh. Zammad 6.3.1: no generic OIDC, so switched Authentik app ‘zammad’ to SAML provider and enabled auth_saml in Zammad (ssl_verify off for pre-check only; assertion signature cert loaded); local password login kept. Tactical RMM SSO (EE-licensed feature) NOT enabled pending license decision; Invoice Ninja 5.13.47 has no generic OIDC (Google/Microsoft/Apple only); MeshCentral not changed (TRMM-managed config). Cloudflare API token was provided by user in chat.</td></tr>
<tr><td><strong>2026-10-13 01:10:38</strong></td><td>Purchase transaction margin simulation (Invoice Ninja test records)</td><td>Read Syncro catalog (126 products, cost vs retail). In Invoice Ninja created temporary client ‘ZZ SIMULATION – DELETE ME’ (email sim-test@example.invalid, nothing sent) with 10 test transactions (monthly managed, T&M labor, Microsoft resale, hardware, prepaid block, pass-through, 10% discount, quote->invoice, credit memo, recurring); then force-deleted all of them. Counts before/after identical (9 clients, 0 invoices, 0 quotes, 2 recurring, 0 credits). No config changed.</td></tr>
<tr><td><strong>2026-10-13 01:22:09</strong></td><td>Open-items cleanup: billing bridge, Quest removal, Authentik backup</td><td>srv-msp-01: set INVOICE_NINJA_API_TOKEN (existing company token) and ZAMMAD_API_TOKEN (new ‘MSP Bridge’ token, ticket.agent only) in /opt/msp-suite/.env (backups .env.bak-*), patched bridge/main.py to accept Bearer/Basic auth (backup main.py.bak-*), rebuilt msp-bridge; Zammad: time_accounting on, webhook ‘MSP Bridge – ticket closed’ (basic auth) + trigger on closed state; end-to-end test OK. Quest removed: Invoice Ninja client archived, Tactical RMM empty client deleted, Zammad org inactive. Invoice Ninja addresses filled from Syncro for CSS-STL, Sabreliner, St.Charles IT. Authentik: daily pg_dump cron /opt/authentik/backup.sh (14d). Vaultwarden create still 422 (entries to be added manually). Memory notes updated.</td></tr>
<tr><td><strong>2026-10-13 01:29:44</strong></td><td>Zammad help desk address changed to help@ittechstl.com</td><td>Zammad (tickets.ittechstl.com): renamed email address support@ittechstl.com to help@ittechstl.com (name ‘IT Tech STL Help Desk’); groups Support and Projects use it. Confirmed via Microsoft 365 directory that help@ittechstl.com (‘ITTechSTL.com Helpdesk’) and notify@ittechstl.com both exist as org users. Inbound Microsoft 365 channel still pending Entra app registration.</td></tr>
<tr><td><strong>2026-10-13 01:40:11</strong></td><td>Authentik hardening: recovery, app access groups, alerts</td><td>Authentik (auth.ittechstl.com): applied example password-recovery-by-email blueprint (flow default-recovery-flow) and linked it on the default brand and identification stage; bound groups ‘authentik Admins’ and ‘ITTechSTL Technicians’ to all 13 applications (only those groups can launch); created email notification transport + rule ‘Alert: failed logins and config errors’ for login_failed, configuration_error, suspicious_request to authentik Admins. User supplied an akadmin API key in chat (validated against server, not stored); bootstrap token used for all work.</td></tr>
<tr><td><strong>2026-10-13 01:47:03</strong></td><td>Vaultwarden completed: backup fixed, entries stored, Authentik SSO</td><td>docker01 (10.1.20.18): Vaultwarden daily backup had never worked (sqlite3 not installed, /opt/backups/vaultwarden missing) – installed sqlite3, script now creates the folder, first backup verified (integrity ok, 286 items = live). Root cause of vault CLI 422: server 1.37.4 requires encryptedFor, legacy bw 2023.12.0 omits it; used @bitwarden/cli 2026.9.1 to create 7 items (MSP Suite – Authentik akadmin, API bootstrap token, PostgreSQL, Secret Key, OIDC client for Vaultwarden SSO; Zammad API Token (MSP Bridge); Cloudflare API Token (certbot)). Enabled Authentik OIDC SSO in /opt/stacks/vaultwarden/compose.yml (+.env; backups compose.yml.bak-*, .env.bak-*), SSO_ONLY=false so master-password login unchanged; prevalidate endpoint responds. Temporary CLI session cleared.</td></tr>
<tr><td><strong>2026-10-13 02:03:08</strong></td><td>SSO configured on app servers via Authentik</td><td>Authentik OIDC wired into: Open WebUI (docker01 compose env), Grafana (docker01 syslog stack, added grafana-data volume after backup, DB restored), Immich (system_metadata system-config oauth block, autoRegister off), WordPress (daggerhart OpenID Connect Generic settings; link existing only), Jellyfin 12.1 on dockervm (SSO-Auth 4.0.0.4 plugin installed, SSO-Auth.xml written, branding.xml login link). Created Authentik apps grafana and immich (group-restricted). Backups: /opt/backups/grafana, /opt/backups/immich-system-config-before-sso.json, jellyfin-config-backup-*.tgz, compose .bak-* files. Client secrets saved to Vaultwarden (5 entries). Not done: zabbix01, Xen Orchestra, n8n, orch01, Wazuh (no access), Tactical RMM (EE license), Invoice Ninja (no OIDC). Found old Authentik 2024.8.2 stack still running on docker01.</td></tr>
<tr><td><strong>2026-10-13 03:16:30</strong></td><td>Old Authentik 2024.8.2 on docker01 shut down</td><td>docker01: verified old instance empty (0 apps, 0 providers, no logins 30d), backed up DB dump and stack files to /opt/backups/old-authentik-2024.8.2-*, stopped authentik-* containers (restart=no, not removed), closed ports 9000/9443, Caddy auth.ittechstl.local now 301 redirects to https://auth.ittechstl.com (Caddyfile backup kept). New Authentik, Zammad, Invoice Ninja, Grafana, Open WebUI verified unaffected.</td></tr>
<tr><td><strong>2026-10-13 03:22:25</strong></td><td>Old Authentik removal: Zabbix and docs updated</td><td>Removed old authentik-* containers and image on docker01 (volumes + backups kept). Zabbix (zabbix01): 4 ‘container unhealthy’ problems acknowledged with decommission note; discovery rules re-run; old-stack items on SRV-DOCKER-02 now disabled (Zabbix deletes after 7d lost-resource period); new Authentik items on SRV-MSP-01 untouched. Docs updated: DOCKER_INVENTORY.md (new change log section, backup .bak-20261013) and Obsidian ITTechSTL/05-Post-Deployment-Summary.md (backup .bak-20261013). Memory rule saved: removing devices requires Zabbix + docs updates.</td></tr>
<tr><td><strong>2026-10-13 04:39:04</strong></td><td>Media stack (Jellyfin/Radarr/Prowlarr/qBittorrent) moved onto network shares</td><td>dockervm 10.1.20.65: mounted //10.1.20.10/import -> /mnt/import and /incoming -> /mnt/incoming (fstab, same credentials as mediashare), tested read/write/delete on all three. qBittorrent: watched folder /import saves to /data/torrents (= incoming), tested with a dummy torrent (removed). Radarr: root folder /mediashare/Movies (old /data/movies removed), rename on, hardlinks off, shares /data/torrents with qB. Jellyfin: Shows library -> /mediashare/TV, library scan every 15 min. Migrated 101.7 GB of downloads to incoming (verified 146 files) then removed local duplicates; dockervm root disk 94% -> 16%. Backups: compose, watched_folders.json, fstab, Jellyfin options. No credentials created; user-provided share login matches the existing mount.</td></tr>
<tr><td><strong>2026-10-13 12:04:00</strong></td><td>Built HyperTicketDB High-Speed Ticketing Engine</td><td>Engineered and benchmarked HyperTicketDB at C:\Users\jtanner\HyperTicketDB. Implemented standalone in-memory + binary WAL storage engine featuring group-commit micro-batching (17,778 ops/sec, 815µs p50), O(1) alert storm deduplication (61,785 alerts/sec, 394µs p50), 2.1M reads/sec, trigram full-text search (7,170 queries/sec, 142µs p50), event-sourced SHA-256 audit logs, CRC32 WAL validation with torn-write repair, and REST API on port 8484.</td></tr>
<tr><td><strong>2026-10-13 13:41:03</strong></td><td>Created Syncro & Bank Deposit Reconciler Tool</td><td>Engineered automated reconciliation engine at C:\Users\jtanner\ITTechSTL\Tools\SyncroReconciler. Solves MSP bookkeeping gap by aligning lump-sum bank deposits against individual Syncro customer invoices, factoring in merchant batch net fee deductions (2.9% + .30) and multi-check bundle deposit matching. Generates interactive HTML report dashboard and accountant-ready CSV export.</td></tr>
<tr><td><strong>2026-10-13 17:45:48</strong></td><td>Created Antigravity Skills for Internal Stack</td><td>Created and validated four new Antigravity skills in .agents/skills/: vaultwarden-ops (secrets management & non-blocking bw-old CLI scripts), msp-billing-audit (Invoice Ninja v5 & bank CSV reconciliation), backup-321-cloud (3-2-1 backup verification & S3 sync), and docker-fleet (multi-host 50-container health monitoring & safe rolling restarts). All test scripts executed and verified healthy.</td></tr>
<!-- LOG_ENTRIES_START -->
<!-- LOG_ENTRIES_END -->
</tbody></table></figure>
</div>
</div>
</main>
<footer class="wp-block-template-part">
<footer class="wp-block-group is-layout-constrained wp-block-group-is-layout-constrained has-global-padding" style="padding-top:var(--wp--preset--spacing--50);padding-bottom:var(--wp--preset--spacing--50)">
<div class="wp-block-group alignwide is-content-justification-space-between is-layout-flex wp-container-core-group-is-layout-flex wp-block-group-is-layout-flex wp-container-core-group-is-layout-13b221f0">
<div class="wp-block-group is-layout-constrained wp-block-group-is-layout-constrained has-global-padding"><p class="wp-block-site-title"><a href="https://ittechstl.com" target="_self" rel="home">ITTechSTL Lab Log</a></p>
<p class="wp-block-site-tagline">Production Engineering & Autonomous Homelab Notes</p></div>
<p class="wp-block-paragraph"><a href="https://wp.ittechstl.local/blog/">Blog</a> · <a href="https://wp.ittechstl.local/projects/">Projects</a> · <a href="https://wp.ittechstl.local/specs/">Specs</a> · <a href="https://wp.ittechstl.local/about-jeff/">About Jeff</a> · <a href="https://wp.ittechstl.local/ai-action-log/">Action Log</a></p>
</div>
<p class="alignwide has-small-font-size wp-block-paragraph">ITTechSTL · documented, logged and approved by a person · Hosted locally on docker02 (XCP-ng / Caddy / Redis)</p>
</footer>
</footer>
</div>
<script type="speculationrules">
{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/twentytwentyfive/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}
</script>
<!-- Top Reading Progress Indicator -->
<div id="ts-reading-progress"></div>
<!-- Quick Command Palette / Search Modal -->
<div id="ts-search-backdrop" class="ts-search-backdrop" aria-hidden="true">
<div class="ts-search-modal" role="dialog" aria-modal="true" aria-label="Quick Search">
<div class="ts-search-input-wrap">
<svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="#60a5fa" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
<input type="text" id="ts-search-input" class="ts-search-input" placeholder="Search lab posts, runbooks, code snippets..." autocomplete="off">
<kbd class="ts-kbd">ESC</kbd>
</div>
<div id="ts-search-results" class="ts-search-results">
<div style="padding: 1.5rem; text-align: center; color: #64748b; font-size: 0.9rem;">
Type to search 20+ engineering articles and architecture runbooks...
</div>
</div>
<div class="ts-search-footer">
<div>Navigation: <kbd class="ts-kbd">↑</kbd> <kbd class="ts-kbd">↓</kbd> to select · <kbd class="ts-kbd">↵</kbd> to open</div>
<div>ITTechSTL Lab Search</div>
</div>
</div>
</div>
<script>
document.addEventListener('DOMContentLoaded', function () {
// --- 1. READING PROGRESS BAR ---
const progressBar = document.getElementById('ts-reading-progress');
if (progressBar) {
window.addEventListener('scroll', function () {
const docHeight = document.documentElement.scrollHeight - window.innerHeight;
if (docHeight > 0) {
const percent = Math.min(100, Math.max(0, (window.scrollY / docHeight) * 100));
progressBar.style.width = percent + '%';
}
}, { passive: true });
}
// --- 2. TOC ACTIVE SECTION SCROLL-SPY ---
const tocLinks = document.querySelectorAll('.ts-toc-list li a');
if (tocLinks.length > 0) {
const headings = Array.from(tocLinks).map(link => {
const id = link.getAttribute('data-target');
return document.getElementById(id);
}).filter(Boolean);
window.addEventListener('scroll', function () {
let currentId = '';
const scrollPos = window.scrollY + 140;
headings.forEach(h => {
if (h.offsetTop <= scrollPos) {
currentId = h.id;
}
});
tocLinks.forEach(link => {
if (link.getAttribute('data-target') === currentId) {
link.classList.add('active');
} else {
link.classList.remove('active');
}
});
}, { passive: true });
}
// --- 3. AUTOMATIC 1-CLICK COPY CODE BUTTONS WITH HEADER ---
const codeBlocks = document.querySelectorAll('pre');
codeBlocks.forEach(function (pre) {
if (pre.parentElement.classList.contains('ts-code-container')) return;
const container = document.createElement('div');
container.className = 'ts-code-container';
let lang = 'CODE';
const codeEl = pre.querySelector('code');
const classList = (pre.className + ' ' + (codeEl ? codeEl.className : '')).toLowerCase();
if (classList.includes('powershell') || classList.includes('ps1')) lang = 'POWERSHELL';
else if (classList.includes('bash') || classList.includes('sh')) lang = 'BASH';
else if (classList.includes('yaml') || classList.includes('yml')) lang = 'YAML';
else if (classList.includes('json')) lang = 'JSON';
else if (classList.includes('docker') || classList.includes('compose')) lang = 'DOCKER';
else if (classList.includes('python') || classList.includes('py')) lang = 'PYTHON';
else if (classList.includes('sql')) lang = 'SQL';
else if (pre.textContent.trim().startsWith('$') || pre.textContent.includes('Get-') || pre.textContent.includes('Set-')) lang = 'POWERSHELL';
else if (pre.textContent.trim().startsWith('#') || pre.textContent.includes('curl ') || pre.textContent.includes('docker ')) lang = 'BASH';
const header = document.createElement('div');
header.className = 'ts-code-header';
header.innerHTML = `
<div class="ts-mac-dots">
<span class="ts-dot ts-dot-red"></span>
<span class="ts-dot ts-dot-yellow"></span>
<span class="ts-dot ts-dot-green"></span>
<span class="ts-code-lang">${lang}</span>
</div>
<button type="button" class="ts-copy-btn">
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="13" height="13" rx="2" ry="2"></rect><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"></path></svg>
<span>Copy</span>
</button>
`;
pre.parentNode.insertBefore(container, pre);
container.appendChild(header);
container.appendChild(pre);
const copyBtn = header.querySelector('.ts-copy-btn');
copyBtn.addEventListener('click', function () {
const textToCopy = (codeEl || pre).innerText.trim();
navigator.clipboard.writeText(textToCopy).then(function () {
copyBtn.classList.add('copied');
copyBtn.innerHTML = `
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"></polyline></svg>
<span>Copied!</span>
`;
setTimeout(function () {
copyBtn.classList.remove('copied');
copyBtn.innerHTML = `
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="13" height="13" rx="2" ry="2"></rect><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"></path></svg>
<span>Copy</span>
`;
}, 2000);
});
});
});
// --- 4. BLOG INDEX DYNAMIC CATEGORY PILL FILTER ---
if (window.location.pathname.includes('/blog')) {
const queryBlock = document.querySelector('.wp-block-query');
if (queryBlock) {
const postItems = queryBlock.querySelectorAll('.wp-block-post');
if (postItems.length > 0) {
const categories = new Set(['All']);
postItems.forEach(function (post) {
const badges = post.querySelectorAll('.ts-badge a, .taxonomy-category a');
badges.forEach(b => categories.add(b.textContent.trim()));
});
const filterBar = document.createElement('div');
filterBar.className = 'ts-blog-filter-bar';
categories.forEach(function (cat) {
const pill = document.createElement('button');
pill.type = 'button';
pill.className = 'ts-filter-pill' + (cat === 'All' ? ' active' : '');
pill.textContent = cat;
pill.addEventListener('click', function () {
filterBar.querySelectorAll('.ts-filter-pill').forEach(p => p.classList.remove('active'));
pill.classList.add('active');
postItems.forEach(function (post) {
if (cat === 'All') {
post.style.display = '';
} else {
const postCats = Array.from(post.querySelectorAll('.ts-badge a, .taxonomy-category a')).map(b => b.textContent.trim());
post.style.display = postCats.includes(cat) ? '' : 'none';
}
});
});
filterBar.appendChild(pill);
});
queryBlock.parentNode.insertBefore(filterBar, queryBlock);
}
}
}
// --- 5. CTRL+K COMMAND PALETTE / LIVE REST SEARCH ---
const backdrop = document.getElementById('ts-search-backdrop');
const searchInput = document.getElementById('ts-search-input');
const resultsBox = document.getElementById('ts-search-results');
let selectedIdx = -1;
// Inject a quick search trigger button into navigation if possible
const nav = document.querySelector('.wp-block-navigation__responsive-container-content, .wp-block-navigation, header');
if (nav && !document.getElementById('ts-nav-search-btn')) {
const searchBtn = document.createElement('button');
searchBtn.id = 'ts-nav-search-btn';
searchBtn.type = 'button';
searchBtn.className = 'ts-search-trigger';
searchBtn.innerHTML = `<span>🔍 Search</span> <kbd class="ts-kbd">Ctrl+K</kbd>`;
searchBtn.style.marginLeft = '1rem';
searchBtn.addEventListener('click', openSearch);
nav.appendChild(searchBtn);
}
function openSearch() {
if (!backdrop) return;
backdrop.classList.add('open');
backdrop.setAttribute('aria-hidden', 'false');
setTimeout(() => searchInput && searchInput.focus(), 60);
}
function closeSearch() {
if (!backdrop) return;
backdrop.classList.remove('open');
backdrop.setAttribute('aria-hidden', 'true');
if (searchInput) searchInput.value = '';
}
// Keyboard Shortcut Listener (Ctrl+K or Cmd+K, Escape)
window.addEventListener('keydown', function (e) {
if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'k') {
e.preventDefault();
if (backdrop && backdrop.classList.contains('open')) {
closeSearch();
} else {
openSearch();
}
} else if (e.key === 'Escape' && backdrop && backdrop.classList.contains('open')) {
closeSearch();
}
});
if (backdrop) {
backdrop.addEventListener('click', function (e) {
if (e.target === backdrop) closeSearch();
});
}
// Debounced Live REST Search
let debounceTimer;
if (searchInput) {
searchInput.addEventListener('input', function () {
clearTimeout(debounceTimer);
const query = searchInput.value.trim();
selectedIdx = -1;
if (query.length < 2) {
resultsBox.innerHTML = `
<div style="padding: 1.5rem; text-align: center; color: #64748b; font-size: 0.9rem;">
Type to search 20+ engineering articles and architecture runbooks...
</div>`;
return;
}
resultsBox.innerHTML = `
<div style="padding: 1.5rem; text-align: center; color: #93c5fd; font-size: 0.9rem;">
Searching lab index...
</div>`;
debounceTimer = setTimeout(function () {
fetch('/wp-json/wp/v2/posts?search=' + encodeURIComponent(query) + '&per_page=6&_fields=id,title,link,date')
.then(res => res.json())
.then(posts => {
if (!posts || posts.length === 0) {
resultsBox.innerHTML = `
<div style="padding: 1.5rem; text-align: center; color: #94a3b8; font-size: 0.9rem;">
No matching engineering runbooks found for "<strong>${query}</strong>"
</div>`;
return;
}
resultsBox.innerHTML = posts.map((post, idx) => `
<a href="${post.link}" class="ts-search-result-item" data-index="${idx}">
<div class="ts-search-result-title">${post.title.rendered}</div>
<div class="ts-search-result-meta">Article · Published ${new Date(post.date).toLocaleDateString('en-US', {month: 'short', day: 'numeric', year: 'numeric'})}</div>
</a>
`).join('');
})
.catch(err => {
resultsBox.innerHTML = `
<div style="padding: 1.25rem; text-align: center; color: #ef4444; font-size: 0.85rem;">
Search error: ${err.message}
</div>`;
});
}, 220);
});
// Arrow key navigation inside search results
searchInput.addEventListener('keydown', function (e) {
const items = resultsBox.querySelectorAll('.ts-search-result-item');
if (!items.length) return;
if (e.key === 'ArrowDown') {
e.preventDefault();
selectedIdx = (selectedIdx + 1) % items.length;
highlightItem(items);
} else if (e.key === 'ArrowUp') {
e.preventDefault();
selectedIdx = (selectedIdx - 1 + items.length) % items.length;
highlightItem(items);
} else if (e.key === 'Enter') {
if (selectedIdx >= 0 && items[selectedIdx]) {
e.preventDefault();
window.location.href = items[selectedIdx].href;
}
}
});
function highlightItem(items) {
items.forEach((item, idx) => {
if (idx === selectedIdx) {
item.classList.add('selected');
item.scrollIntoView({ block: 'nearest' });
} else {
item.classList.remove('selected');
}
});
}
}
});
</script>
<script>
document.addEventListener("DOMContentLoaded", function() {
const buttons = document.querySelectorAll(".filter-bar .filter-btn");
const cards = document.querySelectorAll(".featured-case-studies .card");
buttons.forEach(function(btn) {
btn.addEventListener("click", function() {
const filter = this.getAttribute("data-filter");
buttons.forEach(b => b.classList.remove("active"));
this.classList.add("active");
cards.forEach(function(card) {
if (filter === "all" || card.getAttribute("data-category") === filter) {
card.style.display = "";
} else {
card.style.display = "none";
}
});
});
});
});
</script>
<script data-wp-router-options="{"loadOnClientNavigation":true}" fetchpriority="low" id="@wordpress/block-library/navigation/view-js-module" src="https://ittechstl.com/wp-includes/js/dist/script-modules/block-library/navigation/view.min.js?ver=1bf28ded04f9f188bdcb" type="module"></script>
</body>
</html>
<!--
Performance optimized by Redis Object Cache. Learn more: https://wprediscache.com
Retrieved 1301 objects (277 KB) from Redis using Predis (v2.4.1).
-->
|