Adds a slide after the hardware diagram showing the two racks side by side —
the MakerFLOSS rack at Orange Makerspace and the one at home — to make the
point that the module contract is what lets those two rooms run the same
system.
build-slides.sh now copies image files from slides/ into the output tree at
the same relative path. Marp keeps relative image URLs, so without this the
images would 404 on the published site. Guarded against the local build,
where OUTPUT_DIR is the source directory and the copy would be a no-op onto
itself. This is the first deck in the repo with images; the convention is
documented in docs/services/slides.md.
Photos resampled to 1200px on the long edge (~300 KB each) from the 3072x4080
originals.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Last TODO closed: the pre-TAPPaaS setup ran five years uninterrupted and never
had a name.
Guardrail 1 now says 2-3 artefacts rather than three — the Issue is always
there, the ADR and the plan only when the change warrants them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The graph replaces the prose slide that stood in for it — annotated with the
vacation that explains the Sept/Oct 2025 flat spot, and regenerated so August
runs to the 25th (126). Keeps the one line worth saving from the slide it
replaces: the services stayed up through the flat bits.
Also: "every commit" rather than "every line" on the never-push guardrail;
Home Assistant as the suggested first service; evaluation tier calls for two
disks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The ADR-007 rewrite was the move from a flat pile of sequenced scripts to the
manager/controller paradigm — not the dependsOn change. That was an earlier
and separate rewrite, ADR-003: a plain install.sh per module replaced by
dependsOn/provides contracts the platform resolves into an order.
Also: a closing line on the hardware slide that this is one of five known
instances, and the September 2025 gap now answers itself.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Guardrail 1 is now the process that runs before the AI is allowed to type:
an Issue with a defined problem and proposed fix, an ADR reviewed by at least
two people for anything non-obvious, then a design and implementation plan
that says how it will be tested. The eight agent roles move here — they are
what "then the AI takes over" means.
Guardrail 5 replaces "I stayed the reviewer" with the test regime: quick test
on every change, deep test via test-module.sh --deep, test plan authored in
the ADR, and a full regression across every module after implementation.
Test figures reconciled to one scope across the deck (both repos): 195 suites,
34,490 lines, 27% of source.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Drop the commit-graph slide and the two cost slides. Replace all three with
one argument: the platform is expensive to build, but that cost is fixed and
per-site cost is near zero — so it only makes sense shared across many home
labs and SMB sites.
"What I got wrong" becomes "Did I get it all right?" — no, two large rewrites
(ADR-007 numbering to dependsOn, ADR-014 zone tiers to checked state) plus a
predecessor system run for years before this one.
36 slides; the agenda line and the quiet-months slide no longer refer to the
graph that left.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Split the single architecture slide into two: the iron (three nodes, switch,
AP, modem) and the software (foundation band with the AI and productivity
stacks above it). Both read off the running cluster via tappaas-cicd, not
from docs — CPU, RAM, pool topology, link speeds and switch ports are live
values.
The VM layer-cake is inline SVG rather than mermaid: mermaid ignores
`direction LR` inside a subgraph that has a cross-boundary edge, so the bands
came out as a 629x1258 column.
Module slide now counts all three sources — 8 foundation + 12 apps +
21 Community = 41 — and slide 3 is recomputed for today.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Podman and Portainer are one module now — engine plus GUI — so the deck follows:
podman.json, vmid 812, both sockets on the update.sh slide, and the console at
https://lab1.makerfloss.eu because --proxyDomain makes the module the
environment's gateway rather than podman.lab1.makerfloss.eu.
All commands verified against a live install on lab1.
Installed portainer into lab1 on the live system; several slide commands were
wrong. The verb is 'network-manager add', not 'network-manager zone add', and
there is no 'srv' zone here — the live service zone is 'makerfloss'. Status
verbs need the effective name 'portainer-lab1', while 'module add' takes the
base name. The published host is portainer-lab1.lab1.makerfloss.eu, not
portainer.lab1.makerfloss.eu. Adds the repository registration to Demo 2, which
the deck had never shown.
Talk announced at pretalx.varum.dk/sommerhack-2026/talk/WD8EVP/ —
27 August, Taler Teltet, 60 minutes.
Figures come from the repo rather than the abstract: commit counts and the
per-month graph from git log, source counts from src/STATISTICS.md as
regenerated 2026-08-23. Twelve TODO markers remain for the personal
material (costs, the autumn 2025 dip, war stories).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Retargets the deck from podman to portainer: the contract, the three script
slides, both demo slides and the repo-location slide. Demo 3 is now an actual
single sign-on — 'no login form, you are already you' — because Portainer is an
OIDC client and Cockpit never could be.
The test.sh slide keeps the check worth stealing: /api/settings/public reporting
method 3, which catches identity silently falling back to local accounts.
install.sh, update.sh and test.sh get one slide each, with the real content of
each — including why a 401 from Cockpit is a passing test and why test.sh uses
curl -s rather than --fail.
Corrects the identity story: Cockpit is not an OIDC client and cannot be
configured into one, so the contract shows identity:accessControl and the demo
slide is honest that Authentik gates the URL while Cockpit still asks for a
local account. Full analysis in the module's DESIGN.md.
Date 24 August; the demo environment is lab1 (zone lab1, lab1.makerfloss.eu
outside / lab1.internal inside). Adds the upstream 'developing TAPPaaS modules'
topology from tappaas.org ahead of our own repo picture, which now carries
forgejo.makerfloss.eu and highlights that this site tracks main, not stable.
Drops the manager-verbs slide; the demo slides carry the verbs where they are
actually used, with network/environment/module status commands.
Cockpit now logs in via identity:identity rather than a local PAM password, and
identity hand-out uses 'authentik-manager user-recovery-link' so no password is
ever read aloud. NOTE: podman.json in Community does not yet declare
identity:identity — the module needs that change before the session.
Sixteen slides built around the live demo: two orientation diagrams (site
shape with environments/zones/satellite, and the pull-based GitOps repo
topology), a condensed module anatomy anchored on the real podman.json from
Community/src/larsrossen/containers/podman, the three demo beats (test
environment, module add, prove it), and the identity hand-out.
Mermaid subgraph titles collide with the node row under flowchart TB, so both
diagrams use LR; _class directives repeat 'invert' because a local _class
replaces the deck-level one rather than adding to it.
Adds a second Marp source root. Decks under slides/ build to an output path
mirroring their repo path, so slides/TAPPaaS/HOW-TO/NewModule/index.md is
served at slides.makerfloss.eu/TAPPaaS/HOW-TO/NewModule/. Decks in
docs/presentations/ keep their flat URLs.
The deck itself is a frame: structure and headings from the real
src/apps/00-Template anatomy, content still to be written. Unfinished spots
are written as inline `TODO: ...` and rendered in red so a half-finished
deck cannot be presented by accident.
Also fixes the Docker fallback, which could not write to a mktemp directory
on macOS (not shared with Docker Desktop) and must not be passed --user.
Course site moving from the home estate (laser.baobab.band) to
laser.makerfloss.eu. Marked staging until the VPS deploy is verified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Front-door menu of things we could build at a jam session, grouped into
lab foundations, TaPPaaS production, OM tools, and housekeeping. Each
idea carries a "done when" criterion, a status, and a claimable owner.
Linked from the home page and added as a top-level nav entry.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Confirmed on-site 2026-07-17: srv07's single NIC runs eth0 -> pp02:8,
rear-patched to sw06:4 — the patch that restored its LAN path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
srv07 verified on-site 2026-07-17: it is the Ansible/OS host mf04
(i3-4360T 2c/4t, 16 GB, 500 GB HDD, Debian 13), renamed to srv07 to match
the sticker. The naming-scheme migration row said mf04 -> srv05 — corrected
with a dated note. pp02: srv07's LAN path was restored 2026-07-17; the new
rear patch of port 8 is ad hoc and still needs recording.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rack01 layout and cabling changes as physically mounted:
- shf03 moved U21 -> U22; shf04 stays at U21 (pair split).
- New shf05 at front U19 (empty).
- New shelf-mounted switches on shf03: sw07 (4-port 1G unmanaged,
slot 1/left) and sw06 (9-port unmanaged, 8x2.5G + 1x10G, slot 2/right).
- Rewire: sw01:7 -> sw06:1 (repurposed from srv07 uplink),
sw07:1 -> sw06:2, pp01:4 -> sw06:3, sw01:8 mgmt -> pp01:3.
- Drop pp02:8 -> sw01:7 rear patch; srv07 (staging) left without a LAN path.
Regenerated hardware index and rack01 elevation/page.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an optional `chassis_u` field for shelf-mounted devices (their height
in U where they stand on the shelf) and render it:
- gen_rack draws each tower chassis_u U's tall, rising above the 1U shelf
line; rail-mounted devices now paint on top so a PDU within a tower's
span (e.g. pdu03 over srv05/06) stays visible
- occupancy table shows each tower's real U-span (e.g. srv01 U37-U46)
- validate_item checks chassis_u is a positive integer; absent chassis_u
renders byte-identically to before
- set chassis_u for srv01-07 (10/8/6/6/7/7/6U); document the field in the
editing guide; regenerate rack01 artifacts
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rebuild rack01 from the physically remounted hardware:
- Correct stale positions/ports/outlets for pp01, pp02, sw01, pdu01-04
- Model shelves as 1U trays (towers stand above without consuming rack U's);
add shf02 and empty half-depth shf03/shf04
- Add ups01/ups02; reseat nas01/02 and sw02-05; move srv04-07 onto shf02
- Add `wan` hardware kind; add WAN demarcation hosts wan01 (active) and
wan02 (staging)
- Document full live network wiring: srv01-07 -> pp02 -> sw01 (LAN) and
srv01 eth0 -> pp02 -> pp01 -> wan01 (WAN); keep non-active lines
(wan2, working-table patches, sw01 mgmt) in notes only
- Regenerate hardware index + rack01 elevation/network/power artifacts
Also includes the in-progress generator updates (gen_rack.py, gen_overview.py,
Makefile, tests) that the regenerated artifacts depend on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Camilla's "added all devices to rack" commit committed the regenerated
index/rack artifacts but not the new per-device source files, so CI's
drift check failed (regeneration dropped 9 devices that had no source).
Recreate the source files for sw02-sw05, pp02, srv06-srv07 and nas01-nas02
from the committed artifacts (placement, power feeds, network links, and
cluster:tappaas on the servers; specs left as '?' placeholders, optional
port counts omitted). Regeneration is now drift-clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the naming-scheme spec from notes/dev/specs/ into docs/guides/ so it
publishes to docs.makerfloss.eu, add it under the Hardware nav, and link it
from the editing guide. Repoint the stale references in CLAUDE.md and the
migration plan to the new path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add docs/guides/editing-hardware-docs.md covering the frontmatter schema,
rack/shelf/PDU/power/network fields, the `make docs-index` workflow and
CI drift gate, plus dos and don'ts. Kept under docs/guides/ so the
hardware generators don't parse it as a host file. Linked under the
Hardware nav section so it publishes to docs.makerfloss.eu.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mark srv02/srv03 as TaPPaaS nodes 2/3 and clear the completed
BIOS/UEFI todo items on srv01.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Camilla's "Changed PDU values" commit added pdu03/pdu04 frontmatter but
left the auto-generated docs/hardware/index.md stale, failing the CI
drift check. Correct both PDUs from the placeholder racks rack33/rack11
to rack01 (where all current hardware lives) and regenerate the hardware
index and rack01 elevation via `make docs-index`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Shrink global font and tighten spacing so dense slides fit; split the
phasing slide into VPS-edge (1-3) and internal/later (4-5). Remove a
stray </content> line that leaked into the source. Verified all 13
slides fit via per-slide PNG render.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Marp deck for the split-horizon DNS + public exposure design: reuses the
mf01 pattern (TLS at VPS, plain HTTP over wg1 to TaPPaaS Caddy). Two
Mermaid request-flow diagrams, decisions, phasing, isolation, risks.
Publishes to slides.makerfloss.eu on CI.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
