layered-soul/memories/curated/tailscale-network.md

# Tailscale Network

All Clawdie hosts communicate over Tailscale with zero public exposure.

| Host    | Tailscale IP   | OS         | Role                                   |
| ------- | -------------- | ---------- | -------------------------------------- |
| debby   | ${DEBBY_TS_IP}  | Debian 13  | Hermes secondary + soul backup (intermittent laptop) |
| domedog | ${DOMEDOG_TS_IP} | Linux      | Claude agent, secondary builder        |
| osa     | ${OSA_TS_IP}  | FreeBSD 15 | Always-on VPS: orchestrator + colibri board (hermes-osa) |

SSH between hosts uses Tailscale IPs, never public IPs. Each host has its own SSH key. No key sharing between hosts. Config in `~/.ssh/config` with `HostName` pointing to Tailscale IPs and `IdentitiesOnly yes`.
Populate layered-soul: identity, memories, skills, plan (Hermes & Sam) - SOUL.md: full agent identity, operating principles, voice - IDENTITY.md: runtime identity, hosts, boundaries - USER.md: operator context imported from hermes-soul - AGENTS.md: actual operating rules, infrastructure, quick reference - memories/curated/: 5 topics (tailscale, forgejo, agents, projects, vaultwarden) - skills/: 9 cross-harness skills imported from hermes-soul after review - docs/PLAN-CONFIGURE-PRIVATE-REPO.md: configuration plan - Validate: passes clean 2026-06-14 00:21:26 +02:00			`# Tailscale Network`

			`All Clawdie hosts communicate over Tailscale with zero public exposure.`

docs: apply Prettier to current markdown (Sam & Codex) Normalize markdown formatting after the latest main updates.\n\nChecks: python3 scripts/layered_soul.py validate .; npx --yes prettier@3 --check '*/.md'; git diff --check. 2026-06-14 01:48:32 +02:00			`\| Host \| Tailscale IP \| OS \| Role \|`
			`\| ------- \| -------------- \| ---------- \| -------------------------------------- \|`
matrix: move orchestrator to hermes-osa (always-on VPS); debby is intermittent debby is a laptop that powers off periodically; osa is the always-on VPS and already hosts the colibri board. The hub must live where it never disappears, so the orchestrator role moves to hermes-osa; debby drops to secondary agent + soul backup. - AGENTS.md, HOST-MATRIX, agent-roster, tailscale-network: role swap + always-on/ intermittent facts - HOST-MATRIX + CAPABILITY-ROUTING: corrected 'debby orchestrator dispatches' -> osa hosts the board, debby/domedog are clients - integration doc + SOUL/project-structure survivability lines reconciled Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-19 22:50:16 +02:00			`\| debby \| ${DEBBY_TS_IP} \| Debian 13 \| Hermes secondary + soul backup (intermittent laptop) \|`
security(docs): mask Tailscale IPs + bot handles behind fleet.env Real tailnet IPs and Telegram bot handles were being committed in docs/ memories/skills. Scrubbed all tracked markdown to ${VAR} placeholders; real values now live in fleet.env (gitignored) and stay live via 'tailscale status'. - add fleet.env.example (committed) + fleet.env (gitignored); .gitignore *.env - AGENTS.md + HOST-MATRIX: masking convention so it can't recur - also: domedog registered as Colibri agent (image-render/ffmpeg/build lane); correct CAPABILITY-ROUTING example to real registered caps (domedog headless) Past commits not rewritten (history moves to Codeberg at v1.0); this fixes HEAD. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-19 18:19:32 +02:00			`\| domedog \| ${DOMEDOG_TS_IP} \| Linux \| Claude agent, secondary builder \|`
matrix: move orchestrator to hermes-osa (always-on VPS); debby is intermittent debby is a laptop that powers off periodically; osa is the always-on VPS and already hosts the colibri board. The hub must live where it never disappears, so the orchestrator role moves to hermes-osa; debby drops to secondary agent + soul backup. - AGENTS.md, HOST-MATRIX, agent-roster, tailscale-network: role swap + always-on/ intermittent facts - HOST-MATRIX + CAPABILITY-ROUTING: corrected 'debby orchestrator dispatches' -> osa hosts the board, debby/domedog are clients - integration doc + SOUL/project-structure survivability lines reconciled Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-19 22:50:16 +02:00			`\| osa \| ${OSA_TS_IP} \| FreeBSD 15 \| Always-on VPS: orchestrator + colibri board (hermes-osa) \|`
Populate layered-soul: identity, memories, skills, plan (Hermes & Sam) - SOUL.md: full agent identity, operating principles, voice - IDENTITY.md: runtime identity, hosts, boundaries - USER.md: operator context imported from hermes-soul - AGENTS.md: actual operating rules, infrastructure, quick reference - memories/curated/: 5 topics (tailscale, forgejo, agents, projects, vaultwarden) - skills/: 9 cross-harness skills imported from hermes-soul after review - docs/PLAN-CONFIGURE-PRIVATE-REPO.md: configuration plan - Validate: passes clean 2026-06-14 00:21:26 +02:00
			SSH between hosts uses Tailscale IPs, never public IPs. Each host has its own SSH key. No key sharing between hosts. Config in `~/.ssh/config` with `HostName` pointing to Tailscale IPs and `IdentitiesOnly yes`.