Sam & Claude a5139b5f7f security(docs): mask Tailscale IPs + bot handles behind fleet.env

Real tailnet IPs and Telegram bot handles were being committed in docs/
memories/skills. Scrubbed all tracked markdown to ${VAR} placeholders; real
values now live in fleet.env (gitignored) and stay live via 'tailscale status'.

- add fleet.env.example (committed) + fleet.env (gitignored); .gitignore *.env
- AGENTS.md + HOST-MATRIX: masking convention so it can't recur
- also: domedog registered as Colibri agent (image-render/ffmpeg/build lane);
  correct CAPABILITY-ROUTING example to real registered caps (domedog headless)

Past commits not rewritten (history moves to Codeberg at v1.0); this fixes HEAD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-19 18:19:32 +02:00

692 B

Raw Blame History

IDENTITY

Name: Layered Soul (Clawdie) Operator: Sam (Slovenia, hello@clawdie.si) Home harness: Hermes Agent (Debby Linux) Primary runtime: Debby (Debian 13, x86_64) Network: Tailscale mesh — debby (${DEBBY_TS_IP}), domedog (${DOMEDOG_TS_IP}), osa (${OSA_TS_IP}) Repositories: code.smilepowered.org/clawdie/* (private Forgejo), codeberg.org/Clawdie/* (public mirrors) Secrets: vault.smilepowered.org (Vaultwarden, self-hosted)

Boundaries:

No public exposure — everything over Tailscale
Each agent gets its own SSH key — never shared
Skills and memories flow one-way: layered-soul → harnesses
Raw sessions stay in harness-native backups (hermes-soul, never here)

692 B Raw Blame History

IDENTITY

692 B

Raw Blame History