layered-soul/memories/curated/tailscale-network.md

# Tailscale Network

All Clawdie hosts communicate over Tailscale with zero public exposure.

| Host    | Tailscale IP   | OS         | Role                                   |
| ------- | -------------- | ---------- | -------------------------------------- |
| debby   | ${DEBBY_TS_IP}  | Debian 13  | Primary dev machine, Hermes agent home |
| domedog | ${DOMEDOG_TS_IP} | Linux      | Claude agent, secondary builder        |
| osa     | ${OSA_TS_IP}  | FreeBSD 15 | FreeBSD validation, ISO builder        |

SSH between hosts uses Tailscale IPs, never public IPs. Each host has its own SSH key. No key sharing between hosts. Config in `~/.ssh/config` with `HostName` pointing to Tailscale IPs and `IdentitiesOnly yes`.
Populate layered-soul: identity, memories, skills, plan (Hermes & Sam) - SOUL.md: full agent identity, operating principles, voice - IDENTITY.md: runtime identity, hosts, boundaries - USER.md: operator context imported from hermes-soul - AGENTS.md: actual operating rules, infrastructure, quick reference - memories/curated/: 5 topics (tailscale, forgejo, agents, projects, vaultwarden) - skills/: 9 cross-harness skills imported from hermes-soul after review - docs/PLAN-CONFIGURE-PRIVATE-REPO.md: configuration plan - Validate: passes clean 2026-06-14 00:21:26 +02:00			`# Tailscale Network`

			`All Clawdie hosts communicate over Tailscale with zero public exposure.`

docs: apply Prettier to current markdown (Sam & Codex) Normalize markdown formatting after the latest main updates.\n\nChecks: python3 scripts/layered_soul.py validate .; npx --yes prettier@3 --check '*/.md'; git diff --check. 2026-06-14 01:48:32 +02:00			`\| Host \| Tailscale IP \| OS \| Role \|`
			`\| ------- \| -------------- \| ---------- \| -------------------------------------- \|`
security(docs): mask Tailscale IPs + bot handles behind fleet.env Real tailnet IPs and Telegram bot handles were being committed in docs/ memories/skills. Scrubbed all tracked markdown to ${VAR} placeholders; real values now live in fleet.env (gitignored) and stay live via 'tailscale status'. - add fleet.env.example (committed) + fleet.env (gitignored); .gitignore *.env - AGENTS.md + HOST-MATRIX: masking convention so it can't recur - also: domedog registered as Colibri agent (image-render/ffmpeg/build lane); correct CAPABILITY-ROUTING example to real registered caps (domedog headless) Past commits not rewritten (history moves to Codeberg at v1.0); this fixes HEAD. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-19 18:19:32 +02:00			`\| debby \| ${DEBBY_TS_IP} \| Debian 13 \| Primary dev machine, Hermes agent home \|`
			`\| domedog \| ${DOMEDOG_TS_IP} \| Linux \| Claude agent, secondary builder \|`
			`\| osa \| ${OSA_TS_IP} \| FreeBSD 15 \| FreeBSD validation, ISO builder \|`
Populate layered-soul: identity, memories, skills, plan (Hermes & Sam) - SOUL.md: full agent identity, operating principles, voice - IDENTITY.md: runtime identity, hosts, boundaries - USER.md: operator context imported from hermes-soul - AGENTS.md: actual operating rules, infrastructure, quick reference - memories/curated/: 5 topics (tailscale, forgejo, agents, projects, vaultwarden) - skills/: 9 cross-harness skills imported from hermes-soul after review - docs/PLAN-CONFIGURE-PRIVATE-REPO.md: configuration plan - Validate: passes clean 2026-06-14 00:21:26 +02:00
			SSH between hosts uses Tailscale IPs, never public IPs. Each host has its own SSH key. No key sharing between hosts. Config in `~/.ssh/config` with `HostName` pointing to Tailscale IPs and `IdentitiesOnly yes`.