Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 root
|
2ace79fcab | ||
|
root
|
87b4d67067 | ||
|
root
|
7d1db62a8e | ||
|
root
|
9943be5e68 | ||
|
root
|
fa26b7a579 |
@@ -35,8 +35,7 @@ Docker hosts get special attention:
|
||||
| All other CTs | — | LOW — no Docker | apt clean, log rotate |
|
||||
| GPU bare metal (.8, .110) | — | LOW — no Docker on GPU hosts | log rotate |
|
||||
|
||||
> **Decommissioned:** CT 118 (jitsi) — intentionally stopped, not scanned.
|
||||
> **Migrated:** CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
|
||||
> **Note:** CT 118 is now jdownloader (active on storepve). CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
|
||||
|
||||
## Threat Levels
|
||||
|
||||
@@ -275,10 +274,10 @@ one-off GPU builds. No automated post-migration cleanup was in place.
|
||||
### CT Access (via pct-run)
|
||||
| CT | Name | Node | Status |
|
||||
|----|------|------|--------|
|
||||
| 100 | abiba | amdpve | local |
|
||||
| 102 | adguard | acerpve | ✅ reachable |
|
||||
| 100 | abiba | hwepve | local |
|
||||
| 102 | adguard | minipve | ✅ reachable |
|
||||
| 104 | authentik | minipve | ✅ reachable |
|
||||
| 105 | kagentz | amdpve | ✅ reachable |
|
||||
| 105 | kagentz | hwepve | ✅ reachable |
|
||||
| 106 | ra-h-os | storepve | ✅ reachable |
|
||||
| 107 | pbs | storepve | ✅ reachable |
|
||||
| 108 | media | storepve | ✅ reachable |
|
||||
@@ -286,7 +285,7 @@ one-off GPU builds. No automated post-migration cleanup was in place.
|
||||
| 111 | tdunna | amdpve | ✅ reachable |
|
||||
| 112 | tanko | amdpve | ✅ reachable |
|
||||
| 113 | baggy | amdpve | ✅ reachable |
|
||||
| 114 | mumuni | minipve | ✅ reachable |
|
||||
| 114 | mumuni | hwepve | ✅ reachable |
|
||||
| 115 | scottdenya | amdpve | ✅ reachable |
|
||||
| 116 | syslog-api | minipve | ✅ reachable |
|
||||
| 117 | zulip | storepve | ✅ reachable |
|
||||
@@ -303,4 +302,4 @@ one-off GPU builds. No automated post-migration cleanup was in place.
|
||||
|------|-----|------|--------|
|
||||
| docker-vm | 192.168.68.7 | 16 Docker containers, 4 stacks | ✅ reachable |
|
||||
|
||||
> **Decommissioned:** CT 118 (jitsi) — intentionally stopped.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.
|
||||
> **Note:** CT 118 is now jdownloader (active on storepve). CT 119 (infisical-vault) added on minipve.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.
|
||||
@@ -185,7 +185,7 @@ what, and why should I care?
|
||||
|
||||
```
|
||||
❌ "Monitors infrastructure health"
|
||||
✅ "Scans all 5 Proxmox nodes and 19 CTs for disk pressure, checks Docker
|
||||
✅ "Scans all 6 Proxmox nodes and 19 CTs for disk pressure, checks Docker
|
||||
container health on .7/.116/.17, alerts via Telegram DM on RED/CRITICAL"
|
||||
```
|
||||
|
||||
|
||||
+8
-10
@@ -14,9 +14,6 @@ description: >
|
||||
Instability observed near 100K at 256K (now all GPUs at 128K). 128K is the stable ceiling.
|
||||
For larger context needs → fall back to external providers (deepseek).
|
||||
VRAM headroom improved: RTX 3090 ~70%, RTX 5070 ~65%.
|
||||
UPDATED 2026-07-27: gpu-dense swapped to SmartCode-Fable-5-CoT-Reasoning-QKVO-Qwen-3.6-27B-Distilled
|
||||
(UD-Q4_K_XL, ~17.9GB). ~50% fewer thinking tokens via ThinkingCap finetune + Fable 5 CoT
|
||||
distillation for improved coding reasoning. Same 27B base, cleaner fits on RTX 3090.
|
||||
agent: abiba
|
||||
triggers:
|
||||
- on model add/remove
|
||||
@@ -89,7 +86,7 @@ When a model is swapped on a GPU, ONLY the infrastructure layer changes — agen
|
||||
| Alias | GPU | Current Model | Will Route To |
|
||||
|-------|-----|---------------|---------------|
|
||||
| `strix-moe` | Strix Halo (.15) | qwen3.6-35B-udq4 | Whatever runs on Strix Halo |
|
||||
| `gpu-dense` | RTX 3090 (.8) | SmartCode-Fable-5-27B-UD-Q4_K_XL | Whatever runs on RTX 3090 |
|
||||
| `gpu-dense` | RTX 3090 (.8) | qwen3.6-27B-code | Whatever runs on RTX 3090 |
|
||||
| `gpu-light` | RTX 5070 (.110) | gemma-4-12b | Whatever runs on RTX 5070 |
|
||||
|
||||
**Backward compatibility**: Old model-specific names (qwen3.6-27B-code, gemma-4-12b, qwen3.6-35B-udq4) still work
|
||||
@@ -99,7 +96,7 @@ but are deprecated for agent configs. Only the stable aliases survive model swap
|
||||
|
||||
| Model | GPU | Host | VRAM | Ctx | KV Cache | Parallel | Batch/Ubatch | Status |
|
||||
|-------|-----|------|------|-----|----------|----------|-------------|--------|
|
||||
| SmartCode-Fable-5-27B-UD-Q4_K_XL | RTX 3090 | .8 (llm-gpu) | ~17.9/24.6GB (73%) | **128K** | q4_0 | 1 | 2048/1024 | ✅ testing |
|
||||
| qwen3.6-27B-code (MTP) | RTX 3090 | .8 (llm-gpu) | ~17/24.6GB (70%) | **128K** | turbo4 | 2 | default | ✅ 63 tok/s |
|
||||
| gemma-4-12b | RTX 5070 | .110 (ocu-llm) | ~7.8/12.2GB (65%) | 128K | q4_0 | 2 | 2048/1024 | ✅ healthy |
|
||||
| qwen3.6-35B-udq4 | Strix Halo Vulkan | .15 (amdpve) | ~22GB/64GB | 128K | q4_0 | 1 | 4096/1024 | ✅ 65 tok/s |
|
||||
|
||||
@@ -109,7 +106,7 @@ but are deprecated for agent configs. Only the stable aliases survive model swap
|
||||
|
||||
| Model | GPU | Weight | RPM Cap | Timeout |
|
||||
|-------|-----|--------|---------|---------|
|
||||
| SmartCode-Fable-5-27B-UD-Q4_K_XL | RTX 3090 (.8:8080) | **0.55** | 500 | **300s** |
|
||||
| qwen3.6-27B-code | RTX 3090 (.8:8080) | **0.55** | 500 | **300s** |
|
||||
| qwen3.6-35B-udq4 | Strix Halo (.15:8080) | **0.30** | 60 | **300s** |
|
||||
| gemma-4-12b | RTX 5070 (.110:8080) | **0.15** | 200 | **120s** |
|
||||
|
||||
@@ -120,7 +117,7 @@ Note: All syslog-auto entries route directly to GPUs with `api_key: not-needed`.
|
||||
| Model | RPM Cap | Notes |
|
||||
|-------|---------|-------|
|
||||
| strix-moe (qwen3.6-35B-udq4) | 40 | Tight cap — prevents Strix overload |
|
||||
| SmartCode-Fable-5-27B-UD-Q4_K_XL | 500 | High cap — primary workhorse (replaces qwen3.6-27B-code) |
|
||||
| qwen3.6-27B-code | 500 | High cap — primary workhorse |
|
||||
| gemma-4-12b | 500 | High cap — IQ4_NL+MTP, 122 tok/s |
|
||||
|
||||
### Stable Aliases (for agent configs — never change)
|
||||
@@ -250,9 +247,10 @@ If no SSH access, send Zulip DM via abiba-bot with vault update instructions.
|
||||
Fix: trigger roster reload via SSH after restart, or rebuild image with startup load_roster().
|
||||
- **LiteLLM /metrics**: Requires auth. Prometheus uses `/health/liveliness` as workaround.
|
||||
- **VRAM (2026-07-15)**: RTX 3090 at ~17/24.6GB (~70%) with **128K context** (reduced from 256K 2026-07-17). RTX 5070 at ~7.8/12.2GB (~65%) with 128K context + MTP. Strix Halo at ~7GB/64GB.
|
||||
- **RTX 3090 (2026-07-27)**: Swapped to SmartCode-Fable-5-27B-UD-Q4_K_XL. Same 27B base, distilled for ~50% fewer thinking tokens + Fable 5 CoT coding reasoning. Runs via direct llama-server (no MTP for this model). Config: `-c 131072 -ctk q4_0 -ctv q4_0 --flash-attn on --cont-batching`. Sampler: `--temp 0.9 --top-p 0.95 --top-k 60 --min-p 0.0 --repeat-penalty 1.0`. VRAM: ~73%. Service: direct `llama-server` call (no wrapper script).
|
||||
- **RTX 3090 runs `--parallel 2`** with MTP draft (spec-type draft-mtp, spec-draft-n-max 2).
|
||||
- **RTX 3090 config**: `-c 131072 -ctk turbo4 -ctv turbo4 --parallel 2 --flash-attn on --cont-batching --spec-type draft-mtp`. Context reduced to 128K (2026-07-17, was 256K). VRAM: ~70%. Service: `/home/llmuser/llama-wrapper.sh`.
|
||||
- **RTX 5070 config (2026-07-15)**: Switched to IQ4_NL + MTP draft (Q8_0) at 128K context. Gen speed: 122 tok/s. VRAM: ~7.8/12.2GB (~65%). Service: `/home/llmuser/llama-wrapper.sh`. Config: `--model gemma-4-12b-it-IQ4_NL.gguf --spec-draft-model gemma-4-12b-it-Q8_0-MTP.gguf --spec-type draft-mtp --spec-draft-n-max 4 --ctx-size 131072`.
|
||||
- **LiteLLM timeout tuning (verified 2026-07-27)**: SmartCode-Fable-5-27B 300s, gemma-4-12b 120s, qwen3.6-27B-code 300s (legacy), qwen3.6-35B-udq4 300s, strix-moe 300s, syslog-auto routes all 300s. Nginx proxy_read_timeout: 600s. Global request_timeout: 300s.
|
||||
- **LiteLLM timeout tuning (verified 2026-07-16 against `/opt/inference-harness/litellm_config.yaml` on CT 116)**: gemma-4-12b 120s, qwen3.6-27B-code 300s, qwen3.6-35B-udq4 300s, strix-moe 300s, syslog-auto routes all 300s. Nginx proxy_read_timeout: 600s. Global request_timeout: 300s.
|
||||
- **Strix Halo GPU**: Vulkan is the working backend (ROCm/HIP path abandoned — HSA runtime blocked on Debian 13). Build at `/root/llama.cpp/build-vk/`, commit `4fc4ec5` (2026-07-01), ggml 0.15.3 shared-lib arch. Mesa RADV 25.0.7, KHR_coopmat fast path active. ~70 tok/s gen, 532 tok/s prompt. Service: `strix-server.service` on port 8080, model: `qwen3.6-35B-udq4`, alias `strix-moe`, 128K context, flash-attn + q4 KV, multimodal (mmproj loaded).
|
||||
- **Port conflict detection (2026-07-05)**: All 3 GPU wrappers now detect ghost processes squatting port 8080 before starting. `.8` and `.110` use inline pre-start check in `llama-wrapper.sh`; `.15` uses `/usr/local/bin/port-cleanup.sh` ExecStartPre. Replaces the blanket `pkill -9 -x llama-server` on .15 which would kill ALL llama-server instances regardless of port. Ghost detection was the root cause of .8 crash-looping for 27+ restarts (stale pid 25836 squatting 8080 after OOM kill).
|
||||
- **Strix Halo thermal safeguard (2026-07-02)**: `strix-server.service` has `-n 8192` (hard generation cap per request). Without it, `--predict` defaults to -1 (infinity) — a runaway request from .123 (Mumuni) decoded 39,868 tokens over 24 min, pushing Tctl to 98°C (crit 89.8°C) and throttling 70→29 t/s. The cap bounds worst-case generation to ~5 min. Do NOT remove `-n` without a replacement ceiling. Sustained load hits ~84°C even at 92s; the APU is fanless/low-flow. Clients MUST also set `max_tokens`.
|
||||
@@ -267,7 +265,7 @@ If no SSH access, send Zulip DM via abiba-bot with vault update instructions.
|
||||
|
||||
| GPU | Model | Gen tok/s | Prompt tok/s | Baseline | Context |
|
||||
|-----|-------|-----------|--------------|----------|---------|
|
||||
| RTX 3090 (.8) | SmartCode-Fable-5-27B-UD-Q4_K_XL | **TBD** | — | — | **128K** |
|
||||
| RTX 3090 (.8) | qwen3.6-27B-code (MTP) | **63** | — | — | **128K** |
|
||||
| RTX 5070 (.110) | gemma-4-12b (IQ4_NL+MTP) | **191** | — | — | **128K** |
|
||||
| Strix Halo (.15) | qwen3.6-35B-udq4 | **65** | 140 | — | **128K** |
|
||||
|
||||
|
||||
@@ -26,11 +26,11 @@ done
|
||||
|-------|-----|------|-----|---------------|------------|----------|
|
||||
| Tanko | 112 | amdpve | .122 | `tanko` | Infisical vault | Hermes |
|
||||
| Mumuni | 114 | hwepve | .123 | `mumuni` | Infisical vault | Hermes |
|
||||
| Koby | 129 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
|
||||
| Koonimo | 114 | amdpve | ? | `koonimo` | Infisical vault | Hermes |
|
||||
| Koby | 111 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
|
||||
| Koonimo | 113 | amdpve | .114 | `koonimo` | Infisical vault | Hermes |
|
||||
| Shumba | — | 192.168.68.119 | N/A | N/A (DeepSeek) | Hermes (RETIRED — CT119 now Infisical vault) |
|
||||
|
||||
> **Note**: CT hostnames (tdunna→CT129, baggy→CT114) differ from agent identities (koby, koonimo).
|
||||
> **Note**: CT hostnames (tdunna→CT111, baggy→CT113) differ from agent identities (koby, koonimo).
|
||||
|
||||
Access: `pct-run <CT_ID> <command>` — no IPs needed. GPU hosts (.8, .110, .15) use SSH.
|
||||
Keys are stored in Infisical vault (project=agents, env=production) and injected at
|
||||
@@ -169,9 +169,9 @@ pct-run <CT> grep -A8 "vision:" /root/.hermes/config.yaml | grep api_key
|
||||
# Must show both api_key: sk-... and api_key_env: LITELLM_API_KEY
|
||||
```
|
||||
|
||||
### For Koby (CT 129 / tdunna)
|
||||
### For Koby (CT 111 / tdunna)
|
||||
|
||||
Koby runs Hermes on CT 129 (tdunna). Config files at `/root/.hermes/config.yaml`.
|
||||
Koby runs Hermes on CT 111 (tdunna). Config files at `/root/.hermes/config.yaml`.
|
||||
Same Hermes pattern as Tanko/Mumuni/Koonimo — see config sections above.
|
||||
|
||||
**LiteLLM key**: alias `koby` in LiteLLM DB, injected via `infisical run --` wrapper.
|
||||
@@ -253,7 +253,7 @@ EnvironmentFile=/etc/environment # sources LITELLM_API_KEY
|
||||
|
||||
Run the consolidated health check:
|
||||
```bash
|
||||
python3 /root/scripts/agent-health-check.py # v2: now checks all 5 agents including Koby/Koonimo SSH, CT liveness, config YAML, wrapper integrity, vault non-emptiness
|
||||
python3 /root/scripts/agent-health-check.py
|
||||
```
|
||||
This validates all 4 LiteLLM keys, detects GPU port conflicts (ghost processes),
|
||||
verifies gateway liveness, confirms Zulip streaming (`edit_message` present),
|
||||
|
||||
@@ -38,7 +38,7 @@ Sub-agent profiles inherit auth from the main config — no separate keys needed
|
||||
| Mumuni | `mumuni` | 192.168.68.123 | root@.123 | 6 profiles ✱ |
|
||||
| Abiba | `abiba-pi` | 192.168.68.24 | local | — |
|
||||
| Koby | `koby` | CT 111 (tdunna) | Zulip | — |
|
||||
| Koonimo | `koonimo` | CT 114 (baggy) | SSH root | — |
|
||||
| Koonimo | `koonimo` | CT 113 (baggy) | SSH root | — |
|
||||
| Kagenz0 | `kagenz0-*` | ? | Zulip | — |
|
||||
|
||||
> CT hostnames (tdunna, baggy) differ from agent identities (koby, koonimo).
|
||||
|
||||
@@ -13,10 +13,10 @@ description: >
|
||||
against the live system. Policy fields are authoritative. See the
|
||||
`verify-before-mutate` skill.
|
||||
|
||||
**Last verified:** 2026-07-27 — gpu-dense swapped to SmartCode-Fable-5
|
||||
(Qwen3.6-27B distilled, ~50% fewer thinking tokens, improved coding reasoning).
|
||||
Model pricing reduced 100x across all models ($0.15/$0.60 per 1M tokens).
|
||||
All LiteLLM models set to 128K max_model_tokens. See data/learnings.md.
|
||||
**Last verified:** 2026-07-24 — corrected Gitea IP (.17 not .110),
|
||||
AdGuard IP (.10 not .102), AdGuard placement (minipve not acerpve),
|
||||
Abiba placement (hwepve not amdpve), added hwepve as 6th node,
|
||||
added dns.sysloggh.net route.
|
||||
---
|
||||
|
||||
# Infrastructure Control Pattern
|
||||
@@ -109,12 +109,12 @@ description: >
|
||||
| storepve | .6 | 28C | 31GB | docker-vm, ra-h-os, PBS, media, jdownloader, zulip | Docker, storage, chat |
|
||||
| acerpve | .9 | 28C | 31GB | llm-gpu | GPU VMs |
|
||||
| ocupve | .5 | 12C | 14GB | ocu-llm | GPU VMs |
|
||||
| hwepve | .4 | ? | ? | abiba, (mumuni CT 114 stopped) | Agents (new node) |
|
||||
| hwepve | .4 | 12C | 15GB | abiba, kagentz, (mumuni CT 114 stopped) | Agents (new node) |
|
||||
|
||||
> **Note:** CTs on storepve include jdownloader (CT 118). AdGuard (CT 102) is on
|
||||
> minipve at .10, not acerpve. Abiba (CT 100) is on hwepve and now runs Mumuni
|
||||
> Zulip gateway internally. CT 114 (old mumuni container) destroyed 2026-07-26.
|
||||
> Mumuni also has a second instance on minipve at .123 — distinguish by CT ID.
|
||||
> minipve at .10, not acerpve. Abiba (CT 100) is on hwepve, not amdpve. Mumuni
|
||||
> (CT 114) is on hwepve (currently stopped), not minipve. Mumuni also has a
|
||||
> second instance on minipve at .123 — distinguish by CT ID, not hostname.
|
||||
|
||||
### Checks (every 5 min)
|
||||
|
||||
@@ -365,7 +365,7 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent.
|
||||
|---------|--------|-------------|-------------|-------------|--------|
|
||||
| Proxmox API | minipve.sysloggh.net:8006 | 192.168.68.12 | LAN IP | No | ✅ |
|
||||
| LiteLLM | litellm.sysloggh.net | 192.168.68.116 | LAN IP | No | ✅ |
|
||||
| Authentik | auth.sysloggh.net:443 | 192.168.68.11 | CNAME → netbird | **Yes** | ⚠️ |
|
||||
| Authentik | auth.sysloggh.net:443 | 192.168.68.11:9000 | CNAME → netbird | **Yes** | ⚠️ |
|
||||
| Gitea | git.sysloggh.net:443 | 192.168.68.17:3000 | CNAME → netbird | **Yes** | ⚠️ |
|
||||
| Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE |
|
||||
| Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ |
|
||||
@@ -586,8 +586,6 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
|
||||
|
||||
## Appendix B: CT Inventory
|
||||
|
||||
| CT | Name | Node | IP | Role | Agent |
|
||||
|----|------|------|----|------|-------|
|
||||
| CT | Name | Node | IP | Role | Agent |
|
||||
|----|------|------|----|------|-------|
|
||||
| 100 | abiba | **hwepve** | .24 | Pi agent | ✅ pi |
|
||||
@@ -604,6 +602,7 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
|
||||
| 111 | tdunna | amdpve | .129 | Hermes agent | ✅ |
|
||||
| 112 | tanko | amdpve | .122 | Hermes agent | ✅ |
|
||||
| 113 | baggy | amdpve | .114 | Hermes agent | ✅ |
|
||||
| 114 | mumuni | **hwepve** | .123 | Hermes agent (stopped) | ✅ |
|
||||
| 115 | scottdenya | amdpve | .75 | Denya OneCare | ❌ |
|
||||
| 116 | syslog-api | minipve | .116 | LiteLLM + Grafana | ❌ |
|
||||
| 117 | zulip | storepve | .19 | Chat | ❌ |
|
||||
@@ -629,14 +628,14 @@ Source of truth: `/root/scripts/pct-run.sh` or `prose-contracts/scripts/pct-run.
|
||||
| CT | Name | Node | pct-run |
|
||||
|-----|------|------|---------|
|
||||
| 100 | abiba | hwepve | `pct-run 100` |
|
||||
| 105 | kagentz | **hwepve** | `pct-run 105` |
|
||||
| 105 | kagentz | hwepve | `pct-run 105` |
|
||||
| 111 | tdunna | amdpve | `pct-run 111` |
|
||||
| 112 | tanko | amdpve | `pct-run 112` |
|
||||
| 113 | baggy | amdpve | `pct-run 113` |
|
||||
| 115 | scottdenya | amdpve | `pct-run 115` |
|
||||
| 104 | authentik | minipve | `pct-run 104` |
|
||||
| 110 | gitea | minipve | `pct-run 110` |
|
||||
|
||||
| 114 | mumuni | hwepve | `pct-run 114` |
|
||||
| 116 | syslog-api | minipve | `pct-run 116` |
|
||||
| 106 | ra-h-os | storepve | `pct-run 106` |
|
||||
| 107 | proxmox-backup | storepve | `pct-run 107` |
|
||||
@@ -649,35 +648,27 @@ GPU bare-metal hosts (.8 acerpve, .110 ocupve, .15 amdpve) are NOT CTs — use S
|
||||
ssh root@192.168.68.8 # RTX 3090
|
||||
ssh root@192.168.68.110 # RTX 5070
|
||||
ssh root@192.168.68.15 # Strix Halo
|
||||
ssh root@192.168.68.4 # hwepve (abiba, kagentz) — Mumuni runs inside CT 100
|
||||
ssh root@192.168.68.4 # hwepve (abiba, kagentz, mumuni)
|
||||
```
|
||||
|
||||
## Section 7: Agent Health Check v2 (2026-07-26)
|
||||
## Section 7: Agent Health Check (consolidated — 2026-07-05)
|
||||
|
||||
Single non-disruptive check running every 10 minutes via cron
|
||||
(`/root/scripts/agent-health-check.py`). v2 fixes critical gaps:
|
||||
- Koby (.129) and Koonimo (.114) now have SSH hosts — no longer skipped
|
||||
- Agent-specific vault keys (`{NAME}_LITELLM_API_KEY`) not shared master key
|
||||
- CT liveness check via `pct status` on PVE nodes
|
||||
- Config YAML integrity check
|
||||
- Wrapper/CLI integrity check
|
||||
- Vault secret non-emptiness check
|
||||
Replaces 7 scattered Zulip health scripts with a single non-disruptive check
|
||||
running every 10 minutes via cron (`/root/scripts/agent-health-check.py`).
|
||||
|
||||
The script is **read-only** — it never restarts, kills, or modifies anything.
|
||||
Disruptive cron-based gateways restarts (like Mumuni's zulip-watchdog.sh,
|
||||
which was kill+nohup outside systemd) are banned by policy.
|
||||
|
||||
### Checks Performed
|
||||
|
||||
| Check | Frequency | What It Detects |
|
||||
|-------|-----------|-----------------|
|
||||
| LiteLLM key validation | 10 min | All 5 agent-specific keys authenticate (not shared master key) |
|
||||
| LiteLLM key validation | 10 min | All 4 agent keys authenticate and return models |
|
||||
| GPU port conflict | 10 min | Ghost processes squatting port 8080 (ss vs systemd MainPID) |
|
||||
| Gateway liveness | 10 min | Gateway process running, state file readable (all 5 agents) |
|
||||
| Gateway liveness | 10 min | Gateway process running, state file readable |
|
||||
| Zulip streaming | 10 min | `edit_message` present in adapter (streaming supported) |
|
||||
| Recent errors | 10 min | Error count in journald for last 10 min |
|
||||
| CT liveness | 10 min | `pct status` on PVE nodes — catches stopped CTs |
|
||||
| Config YAML integrity | 10 min | Python `yaml.safe_load()` — catches syntax errors |
|
||||
| Wrapper/CLI integrity | 10 min | hermes wrapper exists, infisical path correct, hermes-real reachable |
|
||||
| Vault secrets | 10 min | Agent-specific vault keys are non-empty and start with `sk-` |
|
||||
|
||||
### Disabled Scripts
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
kind: responsibility
|
||||
name: infrastructure-update
|
||||
description: >
|
||||
Autonomous system-wide update contract covering all 5 Proxmox nodes,
|
||||
Autonomous system-wide update contract covering all 6 Proxmox nodes,
|
||||
15+ containers/VMs, and 4 Docker ecosystems. Updates apt packages,
|
||||
Docker images, and container stacks in safe waves with health checks
|
||||
and automatic rollback on failure.
|
||||
@@ -56,10 +56,11 @@ Before ANY update wave:
|
||||
| amdpve (.15) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
|
||||
| acerpve (.9) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
|
||||
| ocupve (.5) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
|
||||
| hwepve (.4) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
|
||||
| CT 100 (.24) | Abiba (pi) | `apt update && apt upgrade -y` | 3 min |
|
||||
| CT 116 (.116) | syslog-api (LiteLLM host) | `apt update && apt upgrade -y` | 3 min |
|
||||
| CT 112 (tanko, amdpve) | Tanko | `apt update && apt upgrade -y` | 3 min |
|
||||
| CT 114 (mumuni, minipve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
|
||||
| CT 114 (mumuni, hwepve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
|
||||
| VM 101 (.8) | llm-gpu (RTX 3090) | `apt update && apt upgrade -y` | 3 min |
|
||||
| VM 103 (.110) | ocu-llm (RTX 5070) | `apt update && apt upgrade -y` | 3 min |
|
||||
|
||||
@@ -117,7 +118,9 @@ After every node reboot, run these checks:
|
||||
container loses its Docker network assignment (SIGKILL during storage
|
||||
outage detaches it from `zulip_default` network). Run:
|
||||
```bash
|
||||
ssh root@192.168.68.19 'docker rm -f zulip-zulip-1 && cd /opt/zulip && docker compose up -d'
|
||||
ssh root@192.168.68.19
|
||||
docker rm -f zulip-zulip-1
|
||||
cd /opt/zulip && docker compose up -d
|
||||
```
|
||||
The compose restart recreates the container on the correct network.
|
||||
|
||||
@@ -218,7 +221,7 @@ When LiteLLM is upgraded to a version supporting per-key MCP grants:
|
||||
|
||||
## Success Criteria
|
||||
|
||||
- [ ] All 5 PVE nodes updated, no reboot-loop
|
||||
- [ ] All 6 PVE nodes updated, no reboot-loop
|
||||
- [ ] All VMs/CTs running post-update
|
||||
- [ ] All Docker containers healthy (VM 109 + CT 116 + CT 117)
|
||||
- [ ] LiteLLM inference passing (syslog-auto test)
|
||||
@@ -234,7 +237,7 @@ After completion, send Zulip DM:
|
||||
```
|
||||
📋 Infrastructure Update — YYYY-MM-DD
|
||||
|
||||
Updated: 5 PVE nodes, 12 CTs/VMs, 30+ containers
|
||||
Updated: 6 PVE nodes, 12 CTs/VMs, 30+ containers
|
||||
Security fixes: N CVEs patched
|
||||
Downtime: <service> <duration>
|
||||
Failures: none / <details>
|
||||
|
||||
@@ -102,7 +102,7 @@ Request → nginx:80 → LiteLLM:4000 → GPU(llama-server, parallel 2)
|
||||
|
||||
- **Health-check script** (`/opt/inference-harness/scripts/litellm-health-check.sh` on CT 116): `gpu-fleet` check fails only on **critical** alerts (warnings are informational). Tests `strix-moe` (not `ornith-1.0-35b`).
|
||||
- **GPU monitor** (`/root/scripts/gpu-monitor-server.py` on pi .24): runs as **systemd unit `gpu-monitor.service`** (was bare `&` process). `gpu_count` includes Strix Halo (was 2, now 3). VRAM alert thresholds: warning 93%, critical 97% (raised from 90/95 — 128K context steady-state is ~70% on RTX 3090, not a fault).
|
||||
- **Agent key monitor** (`/root/scripts/agent-health-check.py` on pi .24, cron `*/10`): v2 (2026-07-26) — reads each agent's **agent-specific** `{NAME}_LITELLM_API_KEY` from Infisical vault (not the shared master key). Covers: LiteLLM keys, GPU ports, agent gateways (all 5 agents now SSHa ble), CT liveness (pct status on PVE nodes), config.yaml YAML integrity, wrapper/CLI integrity, vault secret non-emptiness checks. Fleet roster: tanko (.122), mumuni (.123), koby (.129), koonimo (.114), abiba (.24). Legacy `tdunna`/`baggy` replaced with canonical agent hostnames.
|
||||
- **Agent key monitor** (`/root/scripts/agent-health-check.py` on pi .24, cron `*/10`): reads each agent's **live** `LITELLM_API_KEY` from its gateway process env via SSH — never hardcodes keys (hardcoded keys rot on rotation and caused 9×401/30min). Fleet roster: abiba, tanko, mumuni, koby, koonimo (legacy `tdunna`/`baggy` removed — never existed).
|
||||
- **Stale keys cleaned**: `daily-infra-report.py` SYNTHETIC_API_KEY was stale (`sk-U_ydi3B` → 401); now reads `LITELLM_MASTER_KEY` from env. Deprecated scripts (`router-original.py`, `router-phase0-backup.py`, `apply-fixes.py`) still reference `sk-syslog-local-master-key` but do not actively poll LiteLLM.
|
||||
|
||||
## Maintains
|
||||
|
||||
@@ -31,7 +31,7 @@ Workers execute tasks on whatever infrastructure they're given — SSH to .6,
|
||||
## Why This Matters
|
||||
|
||||
Without enforced delegation, the manager consumes the full iteration budget
|
||||
(60 calls) on single-turn tasks — SSH to 5 nodes, check each VM, read logs —
|
||||
(60 calls) on single-turn tasks — SSH to 6 nodes, check each VM, read logs —
|
||||
leaving no capacity for actual coordination. The result: context overflow
|
||||
(59K tokens in system prompt), iteration exhaustion, and degraded response
|
||||
quality. This contract exists because I blew through my budget checking
|
||||
@@ -82,7 +82,7 @@ it asks the manager (via relay) — it doesn't go find it on its own.
|
||||
|
||||
**This is a hard rule, not a recommendation.** Violating it produces the exact
|
||||
type of discrepancy the kanban pipeline exists to prevent: a review worker finds
|
||||
"5 nodes present" in the raw data but "5/5 online" in the report — even though
|
||||
"6 nodes present" in the raw data but "6/6 online" in the report — even though
|
||||
one of those nodes was unreachable. The report lied because it used data the
|
||||
raw data never provided.
|
||||
|
||||
@@ -137,7 +137,7 @@ delegate_task(
|
||||
```
|
||||
delegate_task(
|
||||
tasks=[
|
||||
{"goal": "Check all 5 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
|
||||
{"goal": "Check all 6 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
|
||||
{"goal": "Check Docker container health on .7/.116/.17", "context": "SSH to each host, check container status"},
|
||||
]
|
||||
)
|
||||
@@ -191,7 +191,7 @@ Only verified results reach Kwame. Format per channel:
|
||||
{
|
||||
"lane_id": "devops-check",
|
||||
"worker": "syslog-devops",
|
||||
"goal": "Check all 5 Proxmox nodes",
|
||||
"goal": "Check all 6 Proxmox nodes",
|
||||
"status": "dispatched|completed|failed",
|
||||
"output_file": "/tmp/node-report.md"
|
||||
}
|
||||
|
||||
@@ -88,7 +88,7 @@ agent: abiba
|
||||
| acerpve | 192.168.68.9 | PVE (hosts llm-gpu qemu/101) |
|
||||
| minipve | 192.168.68.12 | PVE |
|
||||
| amdpve | 192.168.68.15 | PVE + Strix Halo LLM (qwen3.6-35B-udq4, strix-moe) |
|
||||
| hwepve | 192.168.68.4 | PVE (Huawei Matebook 16, 12C/15GB) — hosts Mumuni (lxc/114) migrated from minipve 2026-07-20 |
|
||||
| hwepve | 192.168.68.4 | PVE (Huawei Matebook 16, 12C/15GB) — hosts abiba (lxc/100), kagentz (lxc/105), mumuni (lxc/114). CTs 100/105 migrated from amdpve, CT 114 from minipve 2026-07-20 |
|
||||
|
||||
## Operations
|
||||
|
||||
|
||||
+57
-299
@@ -1,10 +1,10 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
/root/scripts/agent-health-check.py — Consolidated Agent Health Verification v2
|
||||
/root/scripts/agent-health-check.py — Consolidated Agent Health Verification
|
||||
|
||||
Verifies: LiteLLM keys (agent-specific), GPU port conflicts, agent Zulip streaming,
|
||||
gateway liveness, gateway log health, CT liveness, config YAML integrity,
|
||||
wrapper/CLI integrity, vault secret non-emptiness. NEVER restarts anything.
|
||||
Single non-disruptive health check replacing 7 scattered scripts.
|
||||
Verifies: LiteLLM keys, GPU port conflicts, agent Zulip streaming,
|
||||
gateway liveness, and gateway log health. NEVER restarts anything.
|
||||
|
||||
Usage:
|
||||
python3 /root/scripts/agent-health-check.py # Full check
|
||||
@@ -12,40 +12,60 @@ Usage:
|
||||
python3 /root/scripts/agent-health-check.py --quiet # Only output on failure
|
||||
|
||||
Cron: */10 * * * * python3 /root/scripts/agent-health-check.py --quiet
|
||||
|
||||
Changelog:
|
||||
v2 (2026-07-26): Added CT liveness, config validation, wrapper integrity,
|
||||
vault secret emptiness check. Fixed Koby/Koonimo SSH hosts and agent key
|
||||
name format ({NAME}_LITELLM_API_KEY not LITELLM_API_KEY_{NAME}).
|
||||
Fleet roster: tanko (.122), mumuni (.123), koby (.129), koonimo (.114),
|
||||
abiba (.24).
|
||||
"""
|
||||
|
||||
import subprocess, json, sys, os, time
|
||||
from datetime import datetime
|
||||
|
||||
LITELLM = "http://192.168.68.116:80"
|
||||
INFISICAL_PROJECT = "322fceab-39da-4854-a55a-568e76c0f13f"
|
||||
INFISICAL_ENV = "prod"
|
||||
|
||||
# PVE node IPs for CT liveness checks
|
||||
PVE_NODES = {
|
||||
"hwepve": "192.168.68.4",
|
||||
"amdpve": "192.168.68.15",
|
||||
"minipve": "192.168.68.12",
|
||||
"storepve": "192.168.68.6",
|
||||
"acerpve": "192.168.68.9",
|
||||
"ocupve": "192.168.68.5",
|
||||
}
|
||||
def _get_agent_key(agent_name):
|
||||
"""Retrieve agent key from Infisical vault."""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["infisical", "secrets", "get", "LITELLM_API_KEY",
|
||||
"--project=agents", "--env=production", "--plain"],
|
||||
capture_output=True, text=True, timeout=10
|
||||
)
|
||||
if result.returncode == 0:
|
||||
return result.stdout.strip()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Agent definitions: ct, host, user, pve_node, vault_key_name
|
||||
# Fallback: try exporting all secrets
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["infisical", "export", "--project=agents", "--env=production",
|
||||
"--format=dotenv"],
|
||||
capture_output=True, text=True, timeout=10
|
||||
)
|
||||
if result.returncode == 0:
|
||||
for line in result.stdout.splitlines():
|
||||
if line.startswith(f"LITELLM_API_KEY_{agent_name.upper()}") or \
|
||||
(line.startswith("LITELLM_API_KEY=") and agent_name == os.uname().nodename):
|
||||
return line.split("=", 1)[1].strip().strip('"').strip("'")
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
return None
|
||||
|
||||
# Agent keys are pulled from Infisical vault at runtime.
|
||||
# The 'key' field is populated dynamically below.
|
||||
AGENTS = {
|
||||
"tanko": {"ct": 112, "host": "192.168.68.122", "user": "jerome", "pve": "amdpve", "vault_key": "TANKO_LITELLM_API_KEY"},
|
||||
"abiba": {"ct": 100, "host": "192.168.68.24", "user": "root", "pve": "hwepve", "vault_key": None}, # Pi agent + Mumuni Zulip, no vault key
|
||||
"koby": {"ct": 111, "host": "192.168.68.129", "user": "root", "pve": "amdpve", "vault_key": "KOBY_LITELLM_API_KEY"},
|
||||
"koonimo": {"ct": 113, "host": "192.168.68.114", "user": "root", "pve": "amdpve", "vault_key": "KOONIMO_LITELLM_API_KEY"},
|
||||
"tanko": {"ct": 112, "host": "192.168.68.122", "user": "jerome"},
|
||||
"mumuni": {"ct": 114, "host": "192.168.68.123", "user": "root"},
|
||||
"koby": {"ct": 111, "host": None, "user": None},
|
||||
"koonimo": {"ct": 113, "host": None, "user": None},
|
||||
}
|
||||
|
||||
# Inject keys from vault
|
||||
for agent_name in AGENTS:
|
||||
key = _get_agent_key(agent_name)
|
||||
if key:
|
||||
AGENTS[agent_name]["key"] = key
|
||||
else:
|
||||
AGENTS[agent_name]["key"] = None
|
||||
|
||||
GPU_HOSTS = {
|
||||
"gpu-rtx3090 (.8)": {"host": "192.168.68.8", "port": 8080, "service": "llama-server"},
|
||||
"gpu-rtx5070 (.110)": {"host": "192.168.68.110", "port": 8080, "service": "llama-server"},
|
||||
@@ -54,11 +74,6 @@ GPU_HOSTS = {
|
||||
|
||||
FAIL = []
|
||||
|
||||
INFISICAL_TOKEN = os.environ.get("INFISICAL_TOKEN")
|
||||
INFISICAL_API_URL = os.environ.get("INFISICAL_API_URL", "https://vault.sysloggh.net")
|
||||
|
||||
# ── Helpers ──────────────────────────────────────────────────────────
|
||||
|
||||
def ssh(host, cmd, user="root"):
|
||||
"""Execute a command on a remote host, return stdout or None."""
|
||||
try:
|
||||
@@ -97,81 +112,15 @@ def http_json(url, headers=None, timeout=5):
|
||||
except:
|
||||
return None
|
||||
|
||||
def run_infisical(args, quiet=True):
|
||||
"""Run infisical CLI with env-based auth, return stdout or None."""
|
||||
env = os.environ.copy()
|
||||
env["INFISICAL_API_URL"] = INFISICAL_API_URL
|
||||
if INFISICAL_TOKEN:
|
||||
env["INFISICAL_TOKEN"] = INFISICAL_TOKEN
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["/usr/bin/infisical"] + args,
|
||||
capture_output=True, text=True, timeout=15, env=env
|
||||
)
|
||||
return result.stdout.strip() if result.returncode == 0 else None
|
||||
except:
|
||||
return None
|
||||
|
||||
# ── KEY LOOKUP FIX ───────────────────────────────────────────────────
|
||||
|
||||
def _get_agent_key(agent_name, vault_key_name):
|
||||
"""Retrieve agent-specific key from Infisical vault.
|
||||
|
||||
Uses {NAME}_LITELLM_API_KEY format (e.g., TANKO_LITELLM_API_KEY,
|
||||
KOONIMO_LITELLM_API_KEY) which matches actual vault key names.
|
||||
"""
|
||||
if not vault_key_name:
|
||||
return None
|
||||
|
||||
# Primary: get the agent-specific key by name
|
||||
key = run_infisical([
|
||||
"secrets", "get", vault_key_name,
|
||||
"--projectId=" + INFISICAL_PROJECT,
|
||||
"--env=" + INFISICAL_ENV,
|
||||
"--plain",
|
||||
])
|
||||
if key and key.startswith("sk-"):
|
||||
return key
|
||||
|
||||
# Fallback: export all and search for the key name
|
||||
try:
|
||||
export = run_infisical([
|
||||
"export",
|
||||
"--projectId=" + INFISICAL_PROJECT,
|
||||
"--env=" + INFISICAL_ENV,
|
||||
"--format=dotenv",
|
||||
])
|
||||
if export:
|
||||
for line in export.splitlines():
|
||||
if line.startswith(vault_key_name + "="):
|
||||
value = line.split("=", 1)[1].strip().strip('"').strip("'")
|
||||
if value.startswith("sk-"):
|
||||
return value
|
||||
except:
|
||||
pass
|
||||
|
||||
return None
|
||||
|
||||
# Inject keys from vault for each agent
|
||||
for agent_name in AGENTS:
|
||||
info = AGENTS[agent_name]
|
||||
key = _get_agent_key(agent_name, info.get("vault_key"))
|
||||
AGENTS[agent_name]["key"] = key
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 1: LiteLLM Key Validation (agent-specific keys)
|
||||
# CHECK 1: LiteLLM Key Validation
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_keys():
|
||||
for name, agent in AGENTS.items():
|
||||
key = agent.get("key")
|
||||
if not key:
|
||||
print(f" ❌ {name}: NO KEY FOUND (vault empty or unreachable)")
|
||||
FAIL.append(f"key:{name}:no-key")
|
||||
continue
|
||||
data = http_json(f"{LITELLM}/v1/models",
|
||||
headers={"Authorization": f"Bearer {key}"})
|
||||
headers={"Authorization": f"Bearer {agent['key']}"})
|
||||
if data and data.get("data"):
|
||||
model = data["data"][0].get("id", "?")
|
||||
print(f" ✅ {name}: key valid → {model}")
|
||||
@@ -181,7 +130,7 @@ def check_keys():
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 2: GPU Port Conflict Detection (unchanged)
|
||||
# CHECK 2: GPU Port Conflict Detection
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_gpu_ports():
|
||||
@@ -209,6 +158,7 @@ def check_gpu_ports():
|
||||
else:
|
||||
print(f" ⚠️ {label}: svc={svc_status}, port owned by {port_owner}")
|
||||
else:
|
||||
# Verify health endpoint
|
||||
health = ssh(host, f"curl -s --max-time 5 http://localhost:{port}/health")
|
||||
if health and '"status":"ok"' in health:
|
||||
print(f" ✅ {label}: healthy (pid={port_owner})")
|
||||
@@ -221,7 +171,7 @@ def check_gpu_ports():
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 3: Agent Gateway Liveness + Streaming (now covers all agents)
|
||||
# CHECK 3: Agent Gateway Liveness + Streaming
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_agents():
|
||||
@@ -234,11 +184,8 @@ def check_agents():
|
||||
print(f" ⬜ {name} (CT {ct}): cannot SSH — skip liveness check")
|
||||
continue
|
||||
|
||||
# Gateway process
|
||||
# Gateway process (exclude the infisical bash wrapper that contains the same string)
|
||||
pid = ssh(host, "pgrep -f 'hermes_cli.main gateway run' | grep -v infisical | head -1", user=user)
|
||||
if not pid:
|
||||
# Try alternate binary name
|
||||
pid = ssh(host, "pgrep -f 'hermes.*gateway' | grep -v infisical | grep -v bash | head -1", user=user)
|
||||
if not pid:
|
||||
print(f" ❌ {name}: GATEWAY NOT RUNNING")
|
||||
FAIL.append(f"gateway-down:{name}")
|
||||
@@ -256,7 +203,7 @@ def check_agents():
|
||||
else:
|
||||
gw_state, zulip = "no-state-file", "?"
|
||||
|
||||
# Zulip streaming check
|
||||
# Zulip streaming: does adapter have edit_message?
|
||||
adapter_paths = [
|
||||
"~/.hermes/plugins/zulip-platform/adapter.py",
|
||||
"~/.hermes/plugins/platforms/zulip/adapter.py",
|
||||
@@ -273,183 +220,13 @@ def check_agents():
|
||||
r"journalctl --user -u hermes-gateway --since '10 min ago' -o cat --no-pager 2>/dev/null "
|
||||
r"| grep -ci 'error\|traceback\|exception\|401\|403\|500' || echo 0",
|
||||
user=user)
|
||||
recent_errors = (recent_errors or "0").strip().split("\n")[-1]
|
||||
recent_errors = (recent_errors or "0").strip().split("\n")[-1] # take last line
|
||||
|
||||
print(f" {'✅' if gw_state == 'running' and zulip == 'connected' else '⚠️'} "
|
||||
f"{name}: gw={gw_state} zulip={zulip} streaming={streaming} "
|
||||
f"errors_10m={recent_errors.strip() or '0'} pid={pid}")
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 4: CT Liveness (NEW)
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_ct_liveness():
|
||||
"""Check that all agent CTs are running on their PVE nodes."""
|
||||
for name, agent in AGENTS.items():
|
||||
ct = agent["ct"]
|
||||
pve_node = agent.get("pve")
|
||||
if not pve_node:
|
||||
print(f" ⬜ {name} (CT {ct}): no PVE node mapped — skip")
|
||||
continue
|
||||
|
||||
pve_ip = PVE_NODES.get(pve_node)
|
||||
if not pve_ip:
|
||||
print(f" ⬜ {name}: unknown PVE node '{pve_node}' — skip")
|
||||
continue
|
||||
|
||||
status = ssh(pve_ip, f"pct status {ct} 2>/dev/null", user="root")
|
||||
if not status:
|
||||
print(f" ❌ {name} (CT {ct} on {pve_node}): PVE UNREACHABLE")
|
||||
FAIL.append(f"ct-unreachable:{name}:{pve_ip}")
|
||||
elif "running" in status:
|
||||
print(f" ✅ {name} (CT {ct} on {pve_node}): running")
|
||||
elif "stopped" in status:
|
||||
print(f" ❌ {name} (CT {ct} on {pve_node}): STOPPED")
|
||||
FAIL.append(f"ct-stopped:{name}")
|
||||
else:
|
||||
print(f" ⚠️ {name} (CT {ct} on {pve_node}): {status.strip()}")
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 5: Config YAML Integrity (NEW)
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_config_integrity():
|
||||
"""Verify agent config.yaml parses as valid YAML."""
|
||||
for name, agent in AGENTS.items():
|
||||
host = agent.get("host")
|
||||
user = agent.get("user")
|
||||
if not host or not user:
|
||||
print(f" ⬜ {name}: cannot SSH — skip config check")
|
||||
continue
|
||||
|
||||
# Check YAML parses
|
||||
yaml_ok = ssh(host,
|
||||
"python3 -c "
|
||||
'"import yaml; yaml.safe_load(open(\'/root/.hermes/config.yaml\')); print(\'OK\')" '
|
||||
"2>&1 || echo 'FAIL'",
|
||||
user=user)
|
||||
if not yaml_ok:
|
||||
print(f" ❌ {name}: SSH UNREACHABLE (config check skipped)")
|
||||
FAIL.append(f"config-unreachable:{name}")
|
||||
elif "OK" in yaml_ok:
|
||||
print(f" ✅ {name}: config.yaml valid YAML")
|
||||
else:
|
||||
print(f" ❌ {name}: config.yaml YAML ERROR — {yaml_ok[:120]}")
|
||||
FAIL.append(f"config-yaml-error:{name}")
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 6: Wrapper/CLI Integrity (NEW)
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_wrapper_integrity():
|
||||
"""Verify the hermes CLI wrapper exists and can reach hermes-real."""
|
||||
for name, agent in AGENTS.items():
|
||||
host = agent.get("host")
|
||||
user = agent.get("user")
|
||||
if not host or not user:
|
||||
print(f" ⬜ {name}: cannot SSH — skip wrapper check")
|
||||
continue
|
||||
|
||||
# Check wrapper exists
|
||||
wrapper = ssh(host, "ls -la /root/.local/bin/hermes 2>/dev/null", user=user)
|
||||
if not wrapper:
|
||||
# Check alternate wrapper locations
|
||||
wrapper = ssh(host, "which hermes 2>/dev/null; command -v hermes 2>/dev/null", user=user)
|
||||
if not wrapper:
|
||||
print(f" ❌ {name}: NO HERMES CLI WRAPPER FOUND")
|
||||
FAIL.append(f"wrapper-missing:{name}")
|
||||
continue
|
||||
else:
|
||||
print(f" ⚠️ {name}: hermes at {wrapper.strip()} (not ~/.local/bin/hermes)")
|
||||
|
||||
# Check wrapper has correct infisical path
|
||||
infisical_path_valid = ssh(host,
|
||||
"head -20 /root/.local/bin/hermes 2>/dev/null | grep -q '/usr/bin/infisical' && echo OK || echo MISS",
|
||||
user=user)
|
||||
if infisical_path_valid == "MISS":
|
||||
# Check if infisical exists on path
|
||||
inf_actual = ssh(host, "command -v infisical 2>/dev/null", user=user)
|
||||
if not inf_actual:
|
||||
print(f" ❌ {name}: INFISICAL NOT INSTALLED (wrapper broken)")
|
||||
FAIL.append(f"wrapper-no-infisical:{name}")
|
||||
else:
|
||||
print(f" ⚠️ {name}: wrapper infisical path may be wrong (infisical at {inf_actual})")
|
||||
FAIL.append(f"wrapper-infisical-path:{name}")
|
||||
|
||||
# Check hermes-real exists
|
||||
hermes_real = ssh(host,
|
||||
"ls -la /root/.local/bin/hermes-real 2>/dev/null || echo MISS",
|
||||
user=user)
|
||||
if not hermes_real or hermes_real.strip() == "MISS":
|
||||
# Check venv path
|
||||
hermes_real = ssh(host,
|
||||
"ls -la /usr/local/lib/hermes-agent/venv/bin/hermes 2>/dev/null || echo MISS",
|
||||
user=user)
|
||||
if not hermes_real or hermes_real.strip() == "MISS":
|
||||
print(f" ❌ {name}: hermes-real NOT FOUND (wrapper broken)")
|
||||
FAIL.append(f"wrapper-no-hermes-real:{name}")
|
||||
else:
|
||||
print(f" ✅ {name}: hermes-real at alt path")
|
||||
|
||||
# Check the .env file has the key
|
||||
env_has_key = ssh(host,
|
||||
"grep -c 'LITELLM_API_KEY' /root/.hermes/.env 2>/dev/null || echo 0",
|
||||
user=user)
|
||||
if env_has_key and env_has_key.strip() not in ("", "0"):
|
||||
print(f" ✅ {name}: wrapper + .env key present")
|
||||
else:
|
||||
print(f" ⚠️ {name}: .env may be missing LITELLM_API_KEY entry")
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# CHECK 7: Vault Secret Non-Emptiness (NEW)
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def check_vault_secrets():
|
||||
"""Verify agent-specific vault secrets are non-empty and start with sk-."""
|
||||
for name, agent in AGENTS.items():
|
||||
vault_key_name = agent.get("vault_key")
|
||||
if not vault_key_name:
|
||||
continue
|
||||
|
||||
key = agent.get("key")
|
||||
if not key:
|
||||
print(f" ❌ {name}: vault secret {vault_key_name} MISSING or EMPTY")
|
||||
FAIL.append(f"vault-empty:{name}:{vault_key_name}")
|
||||
elif not key.startswith("sk-"):
|
||||
print(f" ❌ {name}: vault secret {vault_key_name} WRONG FORMAT (starts '{key[:8]}...')")
|
||||
FAIL.append(f"vault-bad-format:{name}:{vault_key_name}")
|
||||
else:
|
||||
print(f" ✅ {name}: vault {vault_key_name}=sk-...{key[-4:]}")
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# DEPLOY: copy updated script to /root/scripts/ on local host
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
def deploy_self():
|
||||
"""Copy this script to /root/scripts/agent-health-check.py if out of date."""
|
||||
dest = "/root/scripts/agent-health-check.py"
|
||||
try:
|
||||
with open(__file__, "r") as f:
|
||||
current = f.read()
|
||||
if os.path.isfile(dest):
|
||||
with open(dest, "r") as f:
|
||||
existing = f.read()
|
||||
if current == existing:
|
||||
return # Already deployed
|
||||
# Write new version
|
||||
with open(dest, "w") as f:
|
||||
f.write(current)
|
||||
os.chmod(dest, 0o755)
|
||||
print(f" 📦 Deployed updated script to {dest}")
|
||||
except:
|
||||
pass # Not fatal if deploy fails
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
# MAIN
|
||||
# ═══════════════════════════════════════════════════════════════════
|
||||
@@ -458,12 +235,8 @@ def main():
|
||||
quiet = "--quiet" in sys.argv
|
||||
as_json = "--json" in sys.argv
|
||||
|
||||
# Self-deploy to canonical location
|
||||
if not quiet and "--no-deploy" not in sys.argv:
|
||||
deploy_self()
|
||||
|
||||
if not quiet:
|
||||
print(f"🏥 Agent Health Check v2 — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
|
||||
print(f"🏥 Agent Health Check — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
|
||||
print()
|
||||
|
||||
print("🔑 LiteLLM Keys:")
|
||||
@@ -476,26 +249,11 @@ def main():
|
||||
|
||||
print("🤖 Agent Gateways:")
|
||||
check_agents()
|
||||
print()
|
||||
|
||||
print("🖥️ CT Liveness:")
|
||||
check_ct_liveness()
|
||||
print()
|
||||
|
||||
print("📝 Config Integrity:")
|
||||
check_config_integrity()
|
||||
print()
|
||||
|
||||
print("🔌 Wrapper/CLI Integrity:")
|
||||
check_wrapper_integrity()
|
||||
print()
|
||||
|
||||
print("🔐 Vault Secrets:")
|
||||
check_vault_secrets()
|
||||
|
||||
if FAIL:
|
||||
print(f"\n❌ {len(FAIL)} FAILURE(S): {' | '.join(FAIL)}")
|
||||
if quiet:
|
||||
# In quiet mode, only print failures as a single alert line
|
||||
print(f"ALERT agent-health:{','.join(FAIL)}")
|
||||
elif not quiet:
|
||||
print("\n✅ All checks passed")
|
||||
|
||||
Regular → Executable
+9
-6
@@ -11,31 +11,33 @@ set -euo pipefail
|
||||
# ── CT ID → PVE Node mapping (maintained HERE, not in prose contracts) ──
|
||||
declare -A CT_NODES=(
|
||||
# amdpve (192.168.68.15)
|
||||
[100]=amdpve # abiba
|
||||
[105]=amdpve # kagentz
|
||||
[111]=amdpve # tdunna
|
||||
[112]=amdpve # tanko
|
||||
[113]=amdpve # baggy
|
||||
[115]=amdpve # scottdenya
|
||||
# minipve (192.168.68.12)
|
||||
[102]=minipve # adguard (was acerpve)
|
||||
[104]=minipve # authentik
|
||||
[110]=minipve # gitea
|
||||
[114]=minipve # mumuni
|
||||
[116]=minipve # syslog-api
|
||||
[119]=minipve # infisical-vault
|
||||
# storepve (192.168.68.6)
|
||||
[106]=storepve # ra-h-os
|
||||
[107]=storepve # proxmox-backup
|
||||
[108]=storepve # media
|
||||
[117]=storepve # zulip
|
||||
# acerpve (192.168.68.9)
|
||||
[102]=acerpve # adguard
|
||||
[118]=storepve # jdownloader
|
||||
# acerpve (192.168.68.9) — no CTs (bare metal GPU .8)
|
||||
# hwepve (192.168.68.4)
|
||||
[100]=hwepve # abiba (was amdpve)
|
||||
[105]=hwepve # kagentz (was amdpve)
|
||||
[114]=hwepve # mumuni (was minipve)
|
||||
# ocupve (192.168.68.5) — no CTs (bare metal GPU .110)
|
||||
#
|
||||
# REMOVED CTs (migrated to bare metal, decommissioned, or VMs):
|
||||
# 101 llm-gpu → bare metal 192.168.68.8 (RTX 3090)
|
||||
# 103 ocu-llm → bare metal 192.168.68.110 (RTX 5070)
|
||||
# 109 docker-vm → KVM VM 192.168.68.7 (use direct SSH)
|
||||
# 118 jitsi → stopped, not in service
|
||||
)
|
||||
|
||||
# Each node must be root-accessible via SSH hostname
|
||||
@@ -48,6 +50,7 @@ declare -A NODE_IPS=(
|
||||
[storepve]=192.168.68.6
|
||||
[acerpve]=192.168.68.9
|
||||
[ocupve]=192.168.68.5
|
||||
[hwepve]=192.168.68.4
|
||||
)
|
||||
|
||||
resolve_node() {
|
||||
|
||||
@@ -46,17 +46,19 @@ You are a code reviewer for OpenProse infrastructure contracts in the Syslog Sol
|
||||
|
||||
The infrastructure-control.prose.md contract is the canonical reference for the cluster topology:
|
||||
|
||||
**Proxmox Cluster "Tabiri" (5 nodes):**
|
||||
- amdpve (192.168.68.15): abiba, kagentz, tanko, tdunna, baggy, scottdenya
|
||||
- minipve (192.168.68.12): authentik, gitea, mumuni, syslog-api, jitsi
|
||||
- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, zulip
|
||||
- acerpve (192.168.68.9): llm-gpu, adguard
|
||||
**Proxmox Cluster "Tabiri" (6 nodes):**
|
||||
- amdpve (192.168.68.15): tanko, tdunna, baggy, scottdenya
|
||||
- minipve (192.168.68.12): adguard, authentik, gitea, syslog-api, infisical-vault
|
||||
- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, jdownloader, zulip
|
||||
- acerpve (192.168.68.9): llm-gpu
|
||||
- ocupve (192.168.68.5): ocu-llm
|
||||
- hwepve (192.168.68.4): abiba, kagentz, mumuni
|
||||
|
||||
**CT IDs (verified 2026-07-04 against PVE API):**
|
||||
**CT IDs (verified 2026-07-24 against PVE API):**
|
||||
100:abiba 102:adguard 104:authentik 105:kagentz 106:ra-h-os
|
||||
107:pbs 108:media 110:gitea 111:tdunna 112:tanko
|
||||
113:baggy 114:mumuni 115:scottdenya 116:syslog-api 117:zulip
|
||||
118:jdownloader 119:infisical-vault
|
||||
|
||||
**NO CT 122, CT 123, or .19 exist in the cluster.**
|
||||
|
||||
|
||||
Reference in New Issue
Block a user