Record the Caddy reverse-proxy at /etc/caddy/ (14 *.localhost sites,
mkcert TLS, systemd caddy.service) as a manual override in
docs/tech/manual-overrides.md - no caddy Ansible role exists yet.
Add a 'Local Dev Services' section to docs/tech/stack.md listing all
*.localhost sites and useful Caddy commands.
New learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-
investigation.md: Caddy emits 'context canceled' SSE aborts (~1.5ms) on
onlyoffice.localhost/mcp -> localhost:3847. Upstream verified alive
(HTTP 406 to plain GET = expected). Handed off to GitLab issue
satware/mcp/onlyoffice#92 with 5 hypotheses, 7 tasks, and a proposed
flush_interval -1 + transport http { versions 1.1 } mitigation (not
applied yet to avoid masking root cause).
- Added learning doc for 2026-07-03 session: diagnosed SIGSEGV in
XKeysymToKeycode (missing NULL check on XOpenDisplay), forked Remmina
to gitlab.com/satware, built with FreeRDP3, verified fix, submitted MR.
- Added manual override entry for patched remmina-plugin-rdp.so in
~/.config/remmina/plugins/
- AUR task: replace loop with single paru call, use changed_when: false
(stdout-only match never fired under non-TTY runs) and failed_when: false
so transient AUR failures don't abort the play
- Rename ansible_user -> local_user to avoid shadowing the connection
magic var; update the two references in roles/common/tasks/main.yml
Session record 2026-06-24: YubiKey inventory, GPG commit-signing plan,
reusable SPECCOL inventory/provisioning stick (dock-aware), and full
hardening + provisioning of the Dell Latitude E7250 as the dedicated
air-gapped keygen/forensic host (BIOS A24, Secure Boot, AMT off, radios
off, dist-upgraded, Phase-2 tooling installed). TPM 1.2-only (hardware
limit). Captures key gotchas (yubikey-manager package name, FAT32 +x,
TXT-before-TPM-clear, E7250 not on LVFS) and the refined architecture.
Baby-step plan for hardware-backed OpenPGP commit/tag signing on YubiKey 5
NFC #30836069 (air-gapped keygen, ed25519/cv25519 subkeys, 2y expiry, touch
required). LUKS-encrypted recovery backup on the Type-C USB stick; non-secret
config to be folded into ansible/. HTTPS+GPG-sign (lowest risk); 2nd YubiKey
scheduled as Phase 9 follow-up.
- Add scripts/cleanup.sh for package cleanup (dry-run/apply modes)
- Add scripts/nvidia-recovery.sh for broken GUI recovery
- Update AGENTS.md with new script references
- Change default editor from vim to nvim in bashrc
Co-authored-by: Junie <junie@jetbrains.com>
- Add hyprland.lua.j2 Ansible template with full Lua DSL config
- Update tasks to deploy hyprland.lua instead of hyprland.conf
- Add docs/tech/hyprland-lua-migration.md with API reference,
dispatcher mapping, pitfalls, and validation commands
- Update keybindings doc to reflect .lua config format
Co-authored-by: Junie <junie@jetbrains.com>
- Remove invalid --numlock flag from tuigreet command in greetd config
(not a recognized tuigreet parameter, caused boot error)
- Replace X11-only 'numlockx on' in Hyprland with native
'numlock_by_default = true' in the input section
- Update Ansible template and CHANGELOG accordingly
- New Ansible template for kitty.conf with window_title_bar
- Title bar shows: hostname | cwd | title on every tile
- Document title bar feature in keybindings cheatsheet
- SUPER+Q: killactive (was kitty)
- SUPER+T: exec kitty (new terminal binding)
- SUPER+C: removed (was killactive)
- All monitors set to 60Hz (DP-1 and HDMI-A-1 down from 144Hz)
- Deleted alesi-routine-morning.service and .timer from ~/.config/systemd/user/
- Timer failed daily at 07:45 (exit 128, git outside repo)
- daily-routine.sh script retained for manual use
- Updated CHANGELOG.md and workstation-health.md
Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API
hardware decode config for Chrome 148 on Wayland/Hyprland.
- Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error
- Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland)
- Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts
- Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux*
- Add gnome-libsecret password store for gnome-keyring integration
- Install libva-utils and libva-nvidia-driver packages
- Update driver version to 580.159.03 in hardware inventory
WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified
working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.
Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring
(local cache via org.freedesktop.secrets D-Bus). All apps (himalaya,
git, ssh-agent, JetBrains IDEs, browsers) now read secrets via
libsecret/secret-tool through gnome-keyring.
Changes:
- Install gnome-keyring + rbw, enable as systemd user service
- Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com)
- Migrate 45 meaningful entries from KWallet → BW + GK
- Switch git credential.helper from store to libsecret
- Document: one-pager, ADR, migration checklist, NEXT_STEPS update
- Skill: devops/secrets-migration for reuse
Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in
KWallet) and GitHub CLI token re-auth.
See docs/product/passwords.md for the full guide.
Hyprland 0.53+ requires launching via start-hyprland (watchdog) for
proper crash diagnostics and signal handling. Without it a warning
banner appears on login.
Override package-managed hyprland.desktop with local copy pointing to
start-hyprland. XDG_DATA_DIRS priority ensures the override wins
without modifying system files.
- ansible/roles/hyprland/tasks/main.yml: manage override in ~/.local/share/wayland-sessions/
- docs/adr/0004-start-hyprland-override.md: full decision record
- docs/hyprland-uwsm.md: document override behavior
- Post-update fio benchmark: random read +12.4%, write +15.9% IOPS
- Latency reduced 10-14% for random workloads
- SMART health unchanged: 0 media errors, 0 error log entries
- Firmware research status updated to complete
- Pre-benchmark checklist marked done
Comprehensive benchmark of Samsung PM9A1 NVMe SSD before firmware
update from GXA7401Q to GXA7802Q. Includes SMART health, hdparm,
and fio results (seq/rand read/write, 4K blocks, iodepth=32).
- Researched 7 component categories for available firmware updates
- NVMe SSD (PM9A1): update available GXA7401Q -> GXA7802Q
- Motherboard BIOS F53 is current (no update needed)
- SATA SSD 840 EVO, GPU GTX 1050 Ti: EOL, no updates
- NIC/CPU microcode: managed via kernel/firmware packages
- USB peripherals: no LVFS/fwupd support
- Recommend installing fwupd for future firmware management
mw
ja
