infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cd63df4f591fc6712fd3f9a5ed6d9fb1aa49d562
mw-pfeddersheim-workstation/CHANGELOG.md
T
mw cd63df4f59 docs(caddy): add agent0.localhost reverse proxy + RFC 6761 wildcard learning 
- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090
  (first non-localhost backend; remote LAN host running uvicorn)
- Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf
- Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21
- Key learning: *.localhost wildcard is NOT honored by curl/system
  trust even for single-label subdomains - .localhost is a special-use
  TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects
  prior assumption in stack.md and manual-overrides.md.

Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
2026-07-21 14:08:07 +02:00

14 KiB
Raw Blame History

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Fixed

  • Fixed Hyprland configuration warning/error by changing the DVI-D-1 monitor transform property from a string "1" to an integer 1 (2026-07-09).
  • tuigreet boot error: removed invalid --numlock flag from greetd config (not a valid tuigreet parameter). Replaced X11-only numlockx on in Hyprland with native numlock_by_default = true in the input section (2026-06-01).
  • hypridle SEGV crash loop (ADR N/A, hotfix): sdbus-cpp 2.3.0 had an ABI incompatibility causing hypridle to SIGSEGV in libsdbus-c++.so.2 registerSignalHandler. Fixed by upgrading sdbus-cpp from 2.3.0-1 to 2.3.1-1 (Arch upstream, pulled ahead of Manjaro mirror sync). Also resolves latent ABI issues for hyprlock and xdg-desktop-portal-hyprland (2026-05-22).
  • Resolved kitty cursor keys not working by disabling the TERM=xterm-256color override in .bashrc, allowing Kitty to correctly set TERM=xterm-kitty. Added Ansible management for kitty.conf to ensure proper terminal behavior and shell integration (2026-05-19).
  • system-upgrade role: GRUB menu assertion now matches Manjaro's real menuentry 'Manjaro Linux (Kernel: X.Y.Z-MANJARO x64)' format (counted per-kernel-family) instead of the wrong menuentry .*linux(612|70) regex that always returned 0 hits on Manjaro and broke the live run with a false-negative failure (2026-05-18).
  • system-upgrade role: migration task changed_when now matches pacman's progress lines ^<!--(SECTION)-->(N/M)<!--(--SECTION)-->s+(installing|upgrading|removing)s instead of plain substring matching, so the role's own echo lines no longer trigger spurious changed=true on idempotent re-runs. Verified: second live re-run reports ok=16 changed=0 failed=0 skipped=5 (2026-05-18).
  • Resolved system unresponsiveness issue by addressing critical memory/swap pressure with increased headroom and proactive OOM killing (2026-03-17).
  • Identified failed archlinux-keyring-wkd-sync.service in system health check.

Added

  • Added agent0.localhost (-> reverse_proxy 192.168.0.141:8090, flush_interval -1) to Caddy in a dedicated file /etc/caddy/conf.d/agent0.localhost.conf. First non-localhost backend (remote LAN host running a uvicorn app). Regenerated mkcert cert to add explicit agent0.localhost SAN; cert now has 20 SANs, valid until 2028-10-21 (2026-07-21). Key learning: the *.localhost wildcard is NOT honored by curl/system trust even for single-label subdomains - .localhost is a special-use TLD per RFC 6761, so every subdomain needs an explicit SAN. This corrects the prior assumption in docs/tech/stack.md and docs/tech/manual-overrides.md that single-label subdomains were wildcard-covered. Total *.localhost sites now 18.
  • Regenerated mkcert cert at /etc/caddy/localhost{,-key}.pem to add explicit SANs for platform.localhost, packages.localhost, and onlyoffice.docs.localhost (pre-existing in Caddy config but missing from cert, causing TLS validation failures). Cert now has 19 SANs, valid until 2028-10-12 (2026-07-12).
  • Added platform.localhost (-> localhost:10080, amicron-platform Docker) and packages.localhost (-> localhost:20080, satis Docker) to /etc/caddy/conf.d/localhost-dev.conf. Docker port mappings updated: ~/internal/amicron-platform/docker-compose.override.yml 10080:80, ~/internal/satis/docker-compose.yml nginx 20080:80. Both upstreams plain HTTP on high ports; Caddy terminates TLS. Also documented onlyoffice.docs.localhost in docs/tech/stack.md (pre-existing in Caddy config, was undocumented). Total *.localhost sites now 17. The three form the local E2E test triangle: platform.localhost (ERP) -> packages.localhost (Satis) -> shared Firebird 3.0.14 database (token validation), mirroring the production platform.auc.de + packages.auc.de + shared Firebird setup (2026-07-12).
  • Enabled click-and-drag window movement and resizing under the SUPER modifier, and enabled border dragging to resize tiled windows natively, updating both the Hyprland configuration template and keybindings cheatsheet (2026-07-09).
  • Documented local dev services in docs/tech/stack.md: Caddy (systemd caddy.service on port 443) with 14 *.localhost sites and mkcert TLS at /etc/caddy/. Registered as a manual override in docs/tech/manual-overrides.md (no caddy Ansible role exists yet) (2026-07-06).
  • Investigation learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md: Caddy context canceled SSE aborts (~1.5ms) on onlyoffice.localhost/mcp forwarded to localhost:3847 (OnlyOffice MCP server). Upstream verified alive (HTTP 406 to plain GET = expected). Handed off to GitLab issue satware/mcp/onlyoffice#92 with 5 hypotheses, 7 investigation tasks, and a proposed Caddy flush_interval -1 + transport http { versions 1.1 } mitigation (not applied yet) (2026-07-06).
  • Waybar USB module: auto-mount USB sticks via udisks2, show hover details (device/model/size/fs/mountpoint), left-click opens in yazi, right-click ejects. Script at ~/.config/waybar/scripts/usb.sh, Ansible-managed via hyprland role template waybar_usb_script.sh.j2 (2026-05-22).
  • udisks2 explicitly listed in hyprland_packages (was transitive dep of Dolphin; now direct dep of USB module) (2026-05-22).
  • Yazi optional deps provisioned via Ansible: chafa, 7zip, resvg added to hyprland_packages (2026-05-22).
  • X11 package removal list hyprland_packages_remove in ansible/vars/main.yml with corresponding task in hyprland role — removes xclip and xsel on Wayland-only system (2026-05-22).
  • ADR 0006: Chrome/Chromium normalization and cleanup decision record (2026-05-22).
  • New Ansible role ansible/roles/system-upgrade/ that runs as the first role in workstation.yml. Performs a full pacman -Syu, dual-installs linux612 (LTS, fallback) and linux70 (stable, new default) kernels with matching headers, and verifies both initramfs images and GRUB menu entries post-install. Invoke stand-alone with ansible-playbook ansible/workstation.yml --tags system-upgrade; idempotent on re-runs (2026-05-18).
  • docs/adr/0002-kernel-and-nvidia-strategy.md — ADR documenting the LTS+stable kernel choice and the 575xx → 595.71 NVIDIA migration for Hyprland/Wayland preparation (2026-05-18).
  • Pre-flight safety gate in the new role: aborts if free space on / drops below min_free_root_gb (5 GiB by default) (2026-05-18).
  • Comprehensive NVMe benchmark for Samsung PM9A1 before firmware update: SMART health, hdparm, fio seq/rand benchmarks (2026-04-02). See docs/tech/nvme-benchmark-pre-gxa7802q.md.
  • CLI suite update script scripts/update-cli-suite.sh for Manjaro/Arch tool maintenance (2026-04-02).
  • Created formal stability tests report documenting the 2026-03-17 memory management improvements (2026-03-17).
  • System stability improvements: enabled systemd-oomd and zswap via Ansible (2026-03-17).
  • Memory resource limits for Firebird and Mailpit Docker containers (2026-03-17).
  • Implemented and verified advanced memory optimizations: zswap 30% pool, THP madvise, and proactive kernel reclaim tuning (2026-03-17).
  • Integrated 16GB swap file management into Ansible roles for consistency and persistence (2026-03-17).
  • Comprehensive health report for mw-pfeddersheim-workstation (2026-03-09).

Removed

  • Moved workstation-specific cheatsheets (hyprland-keybindings.md, screenshot-cheatsheet.md, yazi-cheatsheet.md, and the obsolete workstation copy of neovim-cheatsheet.md) to the central learn repository (2026-07-09).
  • alesi-routine-morning.service / alesi-routine-morning.timer user-level systemd units — daily 07:45 morning routine was failing (exit 128, git outside repo). Script scripts/daily-routine.sh retained for manual use (2026-05-26).
  • Tier 1 package cleanup (ADR 0007): removed 25 X11/KDE/legacy packages via Ansible — lightdm, lightdm-slick-greeter, lightdm-settings, sddm, sddm-kcm, sddm-breath-theme, xf86-video-{amdgpu,ati,intel,nouveau,vesa}, xf86-input-synaptics, xterm, xorg-{twm,xinit,xkill,server-xvfb}, x11vnc, numlockx, startup-notification, illyria-wallpaper, ntp, spectacle, pamac-tray-icon-plasma. All have Wayland-native replacements already in use. Frees ~80-120 MiB direct + cascade deps (2026-05-22).
  • Tier 2 package cleanup (ADR 0007): removed KDE Plasma stack — kwin, plasma-desktop, plasma-workspace, kdeplasma-addons, plasma-nm, plasma-pa, plasma-x11-session, kde-gtk-config, powerdevil, xdg-desktop-portal-kde, plasma-integration, dolphin, dolphin-plugins, kdegraphics-thumbnailers. Plus 45 cascade orphan deps. Dolphin replaced by yazi. Frees ~400 MiB total (2026-05-22).
  • Tier 3 package cleanup (ADR 0007): removed ruby (38 packages), love, xorg-server, xf86-input-libinput. No active Ruby usage; no .love files; xorg-server no longer required (xorg-xwayland is independent). Frees ~30 MiB (2026-05-22).
  • Tier 2b: removed kscreen, kscreenlocker (KDE screen management) + 10 cascade orphan deps (libkscreen, kdeclarative, plasma5support, libksysguard, etc.). Freed 35 MiB. Replaced by wlr-randr/hyprlock (2026-05-22).
  • Removed stale org.kde.kwalletd6.service D-Bus stub from ~/.local/share/dbus-1/services/ (was a broken Exec=/bin/true placeholder) (2026-05-22).
  • Disabled bluetooth.service (no BT hardware) and NetworkManager-wait-online.service (unnecessary on wired workstation, speeds up boot) (2026-05-22).
  • Documented PCIe slot misconfiguration: GPU (GTX 1050 Ti) installed in bottom PCIEX4 slot (PCIe 2.0 x4, ~2 GB/s) instead of top PCIEX16 (PCIe 3.0 x16, ~16 GB/s). 8x bandwidth loss. Physical move required. NVMe also running at Gen2 instead of Gen3 (2026-05-22).

Changed

  • Tier 4 package reclassification (ADR 0007): 13 "Misc" packages reclassified to functional domains in docs/tech/stack.md — uv→Python Toolchain, jq→Shell/Terminal, inxi→Hardware, lsof/zram-generator/mkinitcpio-openswap→Core OS, iproute2/openresolv→Network, perl-image-exiftool/icoutils/innoextract-git→Dev Tools, opencl-headers→GPU Compute, libxnvctrl-580xx→NVIDIA. No packages removed; documentation-only change (2026-05-22).
  • Chrome/Chromium normalization: removed all Chromium artifacts — ~/.config/chromium/ (1.4 GB), ~/.local/chrome-cdp/ (8.6 GB), 13 broken PWA .desktop files, 4 stale PWA manifests from Chrome Preferences, chromium-widevine orphan package (17 MB). System now uses google-chrome-stable exclusively with Wayland-native flags (2026-05-22).
  • ~/.bashrc: removed dead BROWSER_CDP_URL auto-population (curl to localhost:9222 on every shell startup) (2026-05-22).
  • ~/.config/chrome-flags.conf: restored Ansible-managed Wayland flags (--ozone-platform=auto, VA-API on NVIDIA, --use-angle=gl, Vulkan disable) — was drifted to X11 mode with garbage flags (2026-05-22).
  • Waybar config: added custom/usb module to modules-right bar (2026-05-22).
  • Waybar style: added CSS for #custom-usb with hover state and color classes (usb-none, usb-unmounted, usb-mounted) (2026-05-22).
  • Executed system-upgrade playbook on the live workstation (2026-05-18). pacman -Syu upgraded 1103 packages; kernel set now linux612 6.12.85-1 (LTS, was 6.12.77-1) + linux70 7.0.3-1 (NEW); NVIDIA migrated to mainline 595.71.05 for both linux612-nvidia and linux70-nvidia; legacy *-nvidia-575xx packages removed. Both /boot/initramfs-6.12-x86_64.img (54 MB) and /boot/initramfs-7.0-x86_64.img (122 MB) generated; GRUB regenerated with menuentries for both kernels. Reboot required: select linux70 from the GRUB "Advanced options for Manjaro Linux" submenu to activate the new kernel and NVIDIA 595.71.05 modules. Logs: logs/system-upgrade-20260518-101253-live.log.
  • NVIDIA driver migrated from the pinned *-nvidia-575xx (575.64.05) branch to the mainline *-nvidia (595.71.05) branch via the new system-upgrade role. linux612-nvidia-575xx, nvidia-575xx-utils, lib32-nvidia-575xx-utils, nvidia-575xx-settings are removed; linux612-nvidia, linux70-nvidia, nvidia-utils, lib32-nvidia-utils, opencl-nvidia, nvidia-settings are installed in one atomic pacman transaction (2026-05-18).
  • ansible/workstation.yml: system-upgrade registered as the first role, guarded by when: os_type == 'archlinux', with tag system-upgrade (2026-05-18).
  • ansible/vars/main.yml: added kernel_packages, nvidia_kernel_modules, nvidia_userspace_packages, nvidia_packages_to_remove, min_free_root_gb so future kernel/driver pins are a one-line change (2026-05-18).
  • docs/tech/setup.md: new bootstrap step "Run system upgrade & kernel install" before the main playbook, with --tags system-upgrade examples and a reboot-into-linux70 callout (2026-05-18).
  • Samsung PM9A1 NVMe firmware update applied: GXA7401Q → GXA7801Q (non-SED variant, reboot pending to activate). All nvme-cli steps succeeded (2026-04-02).
  • Corrected firmware research: GXA7802Q is SED-only (00B07); non-SED drives (00B00) require GXA7801Q. Updated docs/tech/firmware-update-research.md with naming convention and correct source.
  • Updated .gitignore: added logs/ and docs/tech/capabilities/ exclusions (2026-04-02).
  • Increased system swap file size from 4GB to 16GB to prevent OOM-related system hangs (2026-03-17).
  • Updated system status in README.md and docs/tech/workstation-health.md (2026-03-17).
  • Cleaned up deprecated software information from docs/tech/stack.md (2026-03-13).
  • Synchronized software versions across documentation files (2026-03-13).
Reference in New Issue View Git Blame Copy Permalink