- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090
(first non-localhost backend; remote LAN host running uvicorn)
- Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf
- Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21
- Key learning: *.localhost wildcard is NOT honored by curl/system
trust even for single-label subdomains - .localhost is a special-use
TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects
prior assumption in stack.md and manual-overrides.md.
Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
- Added platform.localhost (-> localhost:10080) and packages.localhost
(-> localhost:20080) to stack.md sites table (total now 17)
- Documented onlyoffice.docs.localhost (pre-existing in Caddy config, was undocumented)
- Regenerated mkcert cert with explicit SANs for the 3 new hostnames
(onlyoffice.docs.localhost is multi-label, not covered by *.localhost wildcard)
- Fixed wildcard note: multi-label hosts require explicit SANs
- Updated manual-overrides with cert regeneration row + site delta
- Updated CHANGELOG with cert regen + site additions
Complete the Keep a Changelog compliance started in 441e28b. The second
'### Fixed' block at end of [Unreleased] (kitty, GRUB regex,
changed_when, OOM, keyring) is merged into the first block, preserving
newest-first ordering (2026-05-22 -> 2026-03-17).
Section order remains Fixed -> Added -> Removed -> Changed (pre-existing,
non-standard vs Keep a Changelog's recommended Added-first order).
Reordering all sections is a larger refactor beyond this fix's scope.
Address review feedback on ce99f58:
- Merge the two '### Added' blocks in [Unreleased] into one (Keep a
Changelog: each category appears once). New 2026-07-06 entries now
sit at the top of the existing Added block.
- Add missing period after 'required SSE headers' in the liveness
verification prose (was a run-on sentence).
Record the Caddy reverse-proxy at /etc/caddy/ (14 *.localhost sites,
mkcert TLS, systemd caddy.service) as a manual override in
docs/tech/manual-overrides.md - no caddy Ansible role exists yet.
Add a 'Local Dev Services' section to docs/tech/stack.md listing all
*.localhost sites and useful Caddy commands.
New learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-
investigation.md: Caddy emits 'context canceled' SSE aborts (~1.5ms) on
onlyoffice.localhost/mcp -> localhost:3847. Upstream verified alive
(HTTP 406 to plain GET = expected). Handed off to GitLab issue
satware/mcp/onlyoffice#92 with 5 hypotheses, 7 tasks, and a proposed
flush_interval -1 + transport http { versions 1.1 } mitigation (not
applied yet to avoid masking root cause).
- Remove invalid --numlock flag from tuigreet command in greetd config
(not a recognized tuigreet parameter, caused boot error)
- Replace X11-only 'numlockx on' in Hyprland with native
'numlock_by_default = true' in the input section
- Update Ansible template and CHANGELOG accordingly
- Deleted alesi-routine-morning.service and .timer from ~/.config/systemd/user/
- Timer failed daily at 07:45 (exit 128, git outside repo)
- daily-routine.sh script retained for manual use
- Updated CHANGELOG.md and workstation-health.md
- Resized swap file from 4GB to 16GB.
- Configured zswap pool (30%) and THP (madvise) via GRUB.
- Tuned kernel parameters for proactive reclaim and NVMe write-back.
- Integrated systemd-oomd for user slice monitoring.
- Updated documentation and changelog.
mw
ja