Infrastructure for Agents

Agent-facing map of Sean/log1kal's project infrastructure. Use this as a routing table, not a diary.

Last verified: 2026-05-05T22:14:24Z

Agent contract

• Default project host: atom.
• Tailnet domain: tail6a522.ts.net.
• Host-addressed atom DNS: atom.tail6a522.ts.net.
• Atom LAN IP used by many services: 192.168.1.12.
• Durable Docker config/state convention: /zpool1/docker_configs/<service>/.
• Larger service data may live under /zpool1/docker_data/<service>/.
• Hermes workspace/repo path: /opt/data/workspace inside the Hermes container, mapped to /home/hermes/workspace on atom.
• Prefer Portainer-managed stacks for long-lived services on atom.
• Do not assume hermes has passwordless sudo on atom. It does not.
• Do not edit/redeploy the Hermes stack casually; restarting it can interrupt the active agent session.
• Do not print secrets. This page lists secret locations, not secret values.

Access patterns

Core host: atom

Atom operational rules

1. Use SSH for host commands: ssh atom.tail6a522.ts.net '...'.
2. Use Portainer API for Docker inspection/mutation; hermes does not have direct Docker socket access.
3. Use host-visible bind mounts for service persistence.
4. For services needing tailnet identity, prefer a Tailscale sidecar with network_mode: service:<tailscale-service>.
5. Verify service health after stack changes through the service API, not just container state.

Published / agent-relevant services

Portainer

Use for creating/updating/verifying stacks. TLS is self-signed locally; API clients usually need TLS verification disabled.

Hermes Agent

Notes:

• Current active agent may be running here. Treat stack edits as disruptive.
• SSH key behavior inside Hermes resolves under HERMES_HOME (/opt/data/.ssh) unless an explicit IdentityFile is used.
• Hermes external memory provider is Supermemory; see memory section.

n8n

Use for workflow automation and webhook glue. Webhook base is https://n8n.tail6a522.ts.net/.

MCP memory service

Known REST endpoints:

POST /api/memories
GET  /api/memories
POST /api/search
POST /api/search/by-tag
POST /api/search/by-time
GET  /api/search/similar/{content_hash}

Use this for routine cross-agent durable memory. Do not use Qdrant directly for small preference/fact writes unless building a bulk RAG workflow.

Qdrant

Use for bulk vector search, RAG corpora, document/session archives, and embeddings-backed project indexes.

Ollama / Open WebUI / LiteLLM

Use for local/open model inference when an agent needs tailnet-accessible model serving.

Uptime Kuma

Use for service monitoring. Prefer application-level HTTP/API probes over container-only checks.

ntfy

Use for push notifications and alert delivery. Verify message history via /alerts/json?... when debugging mobile display problems.

OtterWiki

This page is hosted here. OtterWiki stores pages as Markdown files in a Git-backed repository.

Caddy

Use for conventional HTTP reverse proxy/site hosting when not using Tailscale Serve.

SearXNG

Use as a private metasearch endpoint when browser/search tools are constrained.

OpenClaw

Use only if the current task specifically needs OpenClaw. Do not infer its API surface from this page alone.

Kasm browser/desktops

Use for GUI/browser desktop workloads when available. Check current health before depending on them.

Other running services on atom

These exist and may be useful, but many are personal/media/home services rather than agent infrastructure.

Check live Portainer state before using any of these.

Memory architecture

Rules:

• Store durable facts/preferences/architecture decisions in MCP memory or the agent's native memory layer.
• Store large documents, session archives, and embedding corpora in Qdrant-backed workflows.
• Never store secrets in memory or Qdrant.
• Prefer concise, stable facts over task-progress logs.

GitHub / code hosting

• Stay on GitHub. Sean decided not to migrate Git hosting.
• Host-side gh is authenticated on atom as the working GitHub identity.
• For coding work on atom, use /home/hermes/workspace.
• For agents that need reusable shared-memory behavior, install the skill repo:

npx skills add dixie-rom/agent-shared-memory-skill --all

1Password

Do not dump secret values into chat/wiki/logs. If a secret must be referenced, document only its vault/item/field or local file path.

Current Portainer stack inventory

Status codes are Portainer status values from live inspection. 1 generally means active; 2 means inactive/stopped/limited depending on stack state.

Other stacks exist on atom. Query Portainer before making assumptions.

Verification commands

Check Portainer stacks from atom

ssh atom.tail6a522.ts.net 'python3 - <<"PY"
import json, ssl, urllib.request
base = "https://localhost:9443/api"
token = open("/home/hermes/.config/portainer/api_token").read().strip()
ctx = ssl.create_default_context(); ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE
req = urllib.request.Request(base + "/stacks", headers={"X-API-Key": token})
with urllib.request.urlopen(req, context=ctx) as r:
    for s in json.load(r):
        print(s["Id"], s["Name"], s["EndpointId"], s.get("Status"))
PY'

Check Qdrant

ssh atom.tail6a522.ts.net 'curl -fsS http://100.81.104.62:6333/readyz'

Check n8n

ssh atom.tail6a522.ts.net 'curl -fsS https://n8n.tail6a522.ts.net/healthz'

Check ntfy

ssh atom.tail6a522.ts.net 'curl -fsS https://ntfy.tail6a522.ts.net/v1/health'

Pitfalls

• atom.tail6a522.ts.net is the host. Service-specific Tailscale names like n8n.tail6a522.ts.net or aichat.tail6a522.ts.net may belong to sidecars.
• Tailscale Docker env var is usually TS_AUTHKEY, not TS_AUTH_KEY; old stacks may still show historical variants.
• Secret gists are unlisted, not private. Do not use them as a vault.
• Portainer stack files may contain secret values in environment fields. Redact before quoting.
• Container state running is not enough. Hit the health/API endpoint.
• The OtterWiki repository on disk is owned by the wiki container user, so host writes may require container/Portainer-side file updates.