- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090
(first non-localhost backend; remote LAN host running uvicorn)
- Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf
- Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21
- Key learning: *.localhost wildcard is NOT honored by curl/system
trust even for single-label subdomains - .localhost is a special-use
TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects
prior assumption in stack.md and manual-overrides.md.
Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
Deprecated UseIn key usage (portals.conf preferred)
Low priority, functional
Removed (2026-05-22, ADR 0007): All X11 display managers (lightdm, sddm), X11 video/input drivers (xf86-*), X11 tools (xterm, xorg-xinit, x11vnc, etc.), entire KDE Plasma stack (kwin, plasma-desktop, plasma-workspace, plasma-nm, plasma-pa, powerdevil, etc.), and Dolphin (replaced by yazi). greetd+tuigreet is the active DM. Screenshots use grim+slurp+grimblast.
Browsers
Technology
Version
Notes
Google Chrome
148.0.7778.178 (AUR)
Sole browser — Wayland-native, VA-API on NVIDIA
Chromium
removed
All artifacts cleaned 2026-05-22 (see ADR 0006)
OS Context
OS: Linux (Manjaro/Arch Linux based)
Architecture: x86_64
Package Domain Classification (ADR 0007 Tier 4)
Packages previously listed as "Misc" reclassified to functional domains:
Package
New Domain
Role
uv
Python Toolchain
Fast Python package/env manager
jq
Shell/Terminal
JSON processor
inxi
Hardware
System hardware info
lsof
Core OS
List open files
iproute2
Network
Advanced routing/networking
openresolv
Network
DNS resolver management
perl-image-exiftool
Dev Tools
Metadata read/write
icoutils
Dev Tools
ICO/ANE cursor extraction
innoextract-git
Dev Tools
Inno Setup installer extraction
opencl-headers
GPU Compute
OpenCL C headers
libxnvctrl-580xx
NVIDIA
NVML/XNVCTRL for 580xx
zram-generator
Core OS
Systemd zram swap generator
mkinitcpio-openswap
Core OS
Swap resume hook for mkinitcpio
Maintenance Policies
Updates: System-wide updates via pacman managed through maintenance scripts.
Node.js: Global packages managed via pnpm.
Python: Use uv for environment management.
PHP: Managed via system package manager, focused on CLI execution.
Tool Path Summary
Ansible: /usr/bin/ansible
Python: /usr/bin/python
Docker: /usr/bin/docker
Local Dev Services (Manual - not Ansible-managed)
System-level services running on this workstation that are configured manually
outside this repo's Ansible roles. See docs/tech/manual-overrides.md for the
full override table and docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md
for the active Caddy/OnlyOffice investigation.
Caddy (port 443, systemd caddy.service)
Item
Value
Package
caddy (pacman)
Service
caddy.service (enabled, runs as caddy user)
Config
/etc/caddy/Caddyfile + /etc/caddy/conf.d/*.conf (main site file localhost-dev.conf, plus per-service files like agent0.localhost.conf)
TLS cert
mkcert-generated pair at /etc/caddy/localhost{,-key}.pem; includes explicit SANs for all 20 hostnames, valid until 2028-10-21. The *.localhost wildcard is NOT honored by curl/system trust even for single-label subdomains like agent0.localhost (empirically verified 2026-07-21: .localhost is a special-use TLD per RFC 6761); every subdomain MUST be listed explicitly. Multi-label hosts like onlyoffice.docs.localhost additionally require explicit SANs because wildcards only cover one level.
First non-localhost backend (remote host on LAN, uvicorn app). Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf. flush_interval -1 enabled.
Wildcard *.localhost only matches single-label subdomains (e.g. mcp.localhost)
AND is not honored by curl/system trust for the .localhost special-use TLD
(RFC 6761) - every subdomain needs an explicit SAN. Multi-label hosts like
onlyoffice.docs.localhost and demo.satware.com.localhost require explicit
SANs for both reasons.
mw
cd63df4f59