Sam & Claude a5139b5f7f security(docs): mask Tailscale IPs + bot handles behind fleet.env

Real tailnet IPs and Telegram bot handles were being committed in docs/
memories/skills. Scrubbed all tracked markdown to ${VAR} placeholders; real
values now live in fleet.env (gitignored) and stay live via 'tailscale status'.

- add fleet.env.example (committed) + fleet.env (gitignored); .gitignore *.env
- AGENTS.md + HOST-MATRIX: masking convention so it can't recur
- also: domedog registered as Colibri agent (image-render/ffmpeg/build lane);
  correct CAPABILITY-ROUTING example to real registered caps (domedog headless)

Past commits not rewritten (history moves to Codeberg at v1.0); this fixes HEAD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-19 18:19:32 +02:00

723 B

Raw Blame History

Tailscale Network

All Clawdie hosts communicate over Tailscale with zero public exposure.

Host	Tailscale IP	OS	Role
debby	${DEBBY_TS_IP}	Debian 13	Primary dev machine, Hermes agent home
domedog	${DOMEDOG_TS_IP}	Linux	Claude agent, secondary builder
osa	${OSA_TS_IP}	FreeBSD 15	FreeBSD validation, ISO builder

SSH between hosts uses Tailscale IPs, never public IPs. Each host has its own SSH key. No key sharing between hosts. Config in ~/.ssh/config with HostName pointing to Tailscale IPs and IdentitiesOnly yes.

723 B Raw Blame History

Tailscale Network

723 B

Raw Blame History