Daily Worklog: 2026-02-17

Event: 5400 Authentication failed
Failure Reason: 15039 Rejected per authorization profile
Policy Set: Domus_MAB >> Default
Authorization Profile: DenyAccess

{
  "advancedAttributes": [
    {"cisco-av-pair": "psk-mode=ascii"},
    {"cisco-av-pair": "iPSKManager:pskValue"}
  ],
  "vlan": {"nameID": "iPSKManager:vlan"}
}

# Allow ICMP (ping)
sudo ufw allow icmp

# Allow specific service
sudo ufw allow from 10.50.1.0/24 to any port 443

# Delete rule
sudo ufw delete allow ssh

WARN (asciidoctor): skipping reference to missing attribute: print
    file: WRKLOG-2026-02-16.adoc

awk '/ERROR/ \{print}'

awk '/ERROR/ \{print}'

# zsh logic (fish equivalent also added)
if [[ -S "$XDG_RUNTIME_DIR/ssh-agent.socket" ]]; then
    # Systemd user ssh-agent exists (native Linux)
    export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"
else
    # WSL/non-systemd: start ssh-agent if not running
    if [[ -z "$SSH_AUTH_SOCK" ]] || ! ssh-add -l &>/dev/null; then
        eval "$(ssh-agent -s)" > /dev/null
        [[ -f ~/.ssh/id_ed25519_github ]] && ssh-add ~/.ssh/id_ed25519_github 2>/dev/null
    fi
fi

# Check vault status
vault status

# Mount credentials vault
vault mount credentials

# Now gh auth works
gh auth login

domus-windows-ops/
├── docs/asciidoc/
│   ├── antora.yml              # name: windows-ops
│   ├── modules/ROOT/
│   │   ├── nav.adoc
│   │   └── pages/
│   │       ├── index.adoc
│   │       └── certificates/
│   │           ├── index.adoc
│   │           └── wsl-integration.adoc
│   └── package.json
├── Makefile
├── README.adoc
└── .gitignore

origin    git@github.com:EvanusModestus/domus-windows-ops.git
gitlab    git@gitlab.com:EvanusModestus/domus-windows-ops.git
gitea     git@gitea:evanusmodestus/domus-windows-ops.git

- url: https://github.com/EvanusModestus/domus-windows-ops
  branches: main
  start_path: docs/asciidoc
  edit_url: false

ERROR (asciidoctor): target of xref not found: netapi::cli/cloudflare-commands.adoc
ERROR (asciidoctor): target of xref not found: netapi::index.adoc

- url: /home/evanusmodestus/atelier/_bibliotheca/domus-netapi-docs
  start_path: docs/asciidoc
  branches: HEAD
- url: /home/evanusmodestus/atelier/_bibliotheca/domus-ise-ops
  start_path: docs/asciidoc
  branches: HEAD
- url: /home/evanusmodestus/atelier/_bibliotheca/domus-python
  start_path: docs/asciidoc
  branches: HEAD

domus-windows-ops (your component)
  └── includes domus-docs (hub)
        └── has xrefs to netapi::, ise-ops::, python-ops::
              └── MUST include all three in playbook

cd /home/evanusmodestus/atelier/_bibliotheca/domus-docs && \
  git commit --allow-empty -m "chore: trigger rebuild" && \
  git remote | xargs -I {} git push {} main

# Mount credentials vault
vault mount credentials

# Verify auth
gh auth status
glab auth status

#!/usr/bin/env bash
# Create Architectus repositories across GitHub, GitLab, and Gitea
# Usage: create-architectus-repos.sh [--dry-run]

set -euo pipefail

# Configuration
GITHUB_USER="EvanusModestus"
GITLAB_USER="EvanusModestus"
GITEA_HOST="gitea"  # SSH alias from ~/.ssh/config
GITEA_USER="evanusmodestus"
BASE_DIR="/home/evanusmodestus/atelier/_architectus"
DESCRIPTION_PREFIX="Architectus Documentation -"

# Repository definitions: name|description
REPOS=(
    "architectus-docs|Hub - Landing page and aggregation"
    "architectus-linux|Linux system administration, hardening, and automation"
    "architectus-windows|Windows, Active Directory, PowerShell, and GPO"
    "architectus-networking|Networking, routing, switching, NAC, and firewalls"
    "architectus-security|Security, IAM, PKI, secrets management, and compliance"
    "architectus-automation|Automation, Ansible, Terraform, CI/CD, and scripting"
    "architectus-cloud|Cloud platforms - Azure, AWS, OCI, and hybrid"
    "architectus-literature|Literature - Cervantes, Garcia Marquez, Reina Valera"
    "architectus-languages|Languages - Spanish B2-C2, Portuguese A1-B2"
    "architectus-mathematics|Mathematics - Foundations, calculus, linear algebra"
    "architectus-music|Music - Theory, composition, and production"
    "architectus-philosophy|Philosophy - Faith, reason, ethics, and epistemology"
    "architectus-radio|Radio - Amateur radio, RF theory, ionospheric science"
    "architectus-navigation|Navigation - Cartography, celestial, land and sea"
)

DRY_RUN=false
[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true

log() { echo "[$(date '+%H:%M:%S')] $*"; }
run() {
    if $DRY_RUN; then
        echo "[DRY-RUN] $*"
    else
        "$@"
    fi
}

create_github() {
    local repo="$1" desc="$2"
    log "GitHub: Creating $repo"
    run gh repo create "${GITHUB_USER}/${repo}" \
        --public \
        --description "${DESCRIPTION_PREFIX} ${desc}" \
        --source "${BASE_DIR}/${repo}" \
        --remote origin \
        --push
}

create_gitlab() {
    local repo="$1" desc="$2"
    log "GitLab: Creating $repo"
    run glab repo create "${repo}" \
        --public \
        --description "${DESCRIPTION_PREFIX} ${desc}" \
        --defaultBranch main

    # Add remote and push
    cd "${BASE_DIR}/${repo}"
    run git remote add gitlab "git@gitlab.com:${GITLAB_USER}/${repo}.git" 2>/dev/null || true
    run git push gitlab main
}

create_gitea() {
    local repo="$1" desc="$2"
    log "Gitea: Creating $repo"

    # Gitea API (adjust URL to your instance)
    local GITEA_URL="https://gitea.domusdigitalis.dev"
    local GITEA_TOKEN="${GITEA_TOKEN:-}"

    if [[ -z "$GITEA_TOKEN" ]]; then
        log "WARN: GITEA_TOKEN not set, skipping Gitea API call"
        log "      Manual creation required at ${GITEA_URL}"
    else
        run curl -s -X POST "${GITEA_URL}/api/v1/user/repos" \
            -H "Authorization: token ${GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"name\": \"${repo}\", \"description\": \"${DESCRIPTION_PREFIX} ${desc}\", \"private\": false}"
    fi

    # Add remote and push regardless
    cd "${BASE_DIR}/${repo}"
    run git remote add gitea "git@${GITEA_HOST}:${GITEA_USER}/${repo}.git" 2>/dev/null || true
    run git push gitea main 2>/dev/null || log "      Push to gitea failed (repo may not exist yet)"
}

main() {
    log "=== Architectus Repository Creation ==="
    log "Repos: ${#REPOS[@]}"
    log "Dry run: $DRY_RUN"
    echo

    for entry in "${REPOS[@]}"; do
        IFS='|' read -r repo desc <<< "$entry"

        if [[ ! -d "${BASE_DIR}/${repo}" ]]; then
            log "SKIP: ${repo} - directory not found"
            continue
        fi

        echo
        log "=== Processing: $repo ==="

        create_github "$repo" "$desc"
        create_gitlab "$repo" "$desc"
        create_gitea "$repo" "$desc"
    done

    echo
    log "=== Complete ==="
    log "Verify at:"
    log "  GitHub: https://github.com/${GITHUB_USER}?tab=repositories&q=architectus"
    log "  GitLab: https://gitlab.com/${GITLAB_USER}?filter=architectus"
}

main "$@"

# Make executable
chmod +x ~/bin/create-architectus-repos.sh

# Dry run first
create-architectus-repos.sh --dry-run

# Execute
create-architectus-repos.sh

for repo in docs linux windows networking security automation cloud literature languages mathematics music philosophy radio navigation; do
    cd "/home/evanusmodestus/atelier/_architectus/architectus-${repo}"
    echo "=== architectus-${repo} ==="
    for remote in origin gitlab gitea; do
        git push "$remote" main 2>/dev/null && echo "  ✓ $remote" || echo "  ✗ $remote"
    done
done

# Generate token at: https://gitea.domusdigitalis.dev/user/settings/applications
# Save to vault
echo "YOUR_GITEA_TOKEN" > ~/.config/gitea/token
chmod 600 ~/.config/gitea/token

# Export before running script
export GITEA_TOKEN=$(cat ~/.config/gitea/token)

# List all remotes for all repos
for d in /home/evanusmodestus/atelier/_architectus/architectus-*/; do
    echo "=== $(basename "$d") ==="
    git -C "$d" remote -v
done

# Check GitHub repo status
gh repo list EvanusModestus --limit 50 | grep architectus

# Check GitLab
glab repo list | grep architectus

#!/usr/bin/env bash
# ~/bin/architectus-push
# Usage: architectus-push [--status]

set -euo pipefail

BASE_DIR="/home/evanusmodestus/atelier/_architectus"
REPOS=(architectus-{docs,linux,windows,networking,security,automation,cloud,literature,languages,mathematics,music,philosophy,radio,navigation})
REMOTES=("origin" "gitlab" "gitea")

GREEN='\033[0;32m'
YELLOW='\033[0;33m'
RED='\033[0;31m'
NC='\033[0m'

status_only=false
[[ "${1:-}" == "--status" ]] && status_only=true

for repo in "${REPOS[@]}"; do
    dir="${BASE_DIR}/${repo}"
    [[ ! -d "$dir" ]] && { echo -e "${RED}SKIP${NC}: $repo"; continue; }

    echo -e "=== ${GREEN}${repo}${NC} ==="

    if $status_only; then
        git -C "$dir" status -s
        continue
    fi

    for remote in "${REMOTES[@]}"; do
        if git -C "$dir" remote get-url "$remote" &>/dev/null; then
            if git -C "$dir" push "$remote" main 2>/dev/null; then
                echo -e "  ${GREEN}✓${NC} $remote"
            else
                echo -e "  ${RED}✗${NC} $remote"
            fi
        else
            echo -e "  ${YELLOW}-${NC} $remote (not configured)"
        fi
    done
done
echo -e "\n=== Complete ==="

logins:
    - name: gitea
      url: https://gitea-01.inside.domusdigitalis.dev:3000  # Port required!
      token: <from-vault>
      default: true
      # NO ssh_key line - causes prompting bug
      ssh_host: gitea-01.inside.domusdigitalis.dev
      ssh_agent: true
      user: evanusmodestus

v3/
├── domains/
│   ├── d000/                    # Personal Infrastructure
│   │   ├── hardware/            # IPMI, printers, IoT
│   │   ├── identity/            # AD, IPA, Keycloak, LDAP
│   │   ├── network/
│   │   │   ├── devices/         # Switch/router/firewall logins
│   │   │   ├── radius/          # RADIUS shared secrets
│   │   │   ├── snmp/            # Community strings
│   │   │   ├── routing/         # OSPF/EIGRP/BGP keys
│   │   │   └── tacacs/          # TACACS+ secrets
│   │   ├── servers/
│   │   ├── storage/             # NAS, S3, backup
│   │   └── wifi/                # PSKs
│   └── d001/                    # Client (CHLA)
│       ├── identity/
│       └── network/
├── keys/
│   ├── ssh/
│   │   ├── personal/            # github, gitlab, gitea
│   │   └── service/             # deploy keys, automation
│   ├── age/
│   ├── gpg/
│   └── encryption/              # borg, veracrypt, LUKS
├── certificates/                # Cert passphrases, PFX
├── licenses/                    # Software licenses
└── personal/                    # Consumer/personal
    ├── finance/                 # Banking, investments
    ├── shopping/                # Amazon, eBay
    ├── social/                  # Twitter, LinkedIn
    ├── streaming/               # Netflix, Spotify
    ├── gaming/                  # Steam, GOG
    ├── email/
    ├── documents/               # Encrypted doc passwords
    ├── recovery/                # 2FA backup codes
    ├── travel/                  # Airlines, hotels
    ├── health/                  # Health portals
    └── government/              # DMV, IRS, SSA

# Initialize v3 store
gopass init --store v3

# Create structure with .meta placeholders
echo "description" | gopass insert -m v3/path/to/.meta

# Add remotes
git -C ~/.local/share/gopass/stores/v3 remote add origin git@github.com:EvanusModestus/gopass-v3.git
git -C ~/.local/share/gopass/stores/v3 remote add gitlab git@gitlab.com:EvanusModestus/gopass-v3.git
git -C ~/.local/share/gopass/stores/v3 remote add gitea git@gitea:evanusmodestus/gopass-v3.git

# Create Gitea repo via API (push-to-create disabled)
curl -sk -X POST "https://gitea-01.inside.domusdigitalis.dev:3000/api/v1/user/repos" \
  -H "Authorization: token $GITEA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"gopass-v3","private":true}'

# Push to all remotes
git -C ~/.local/share/gopass/stores/v3 push origin main
git -C ~/.local/share/gopass/stores/v3 push gitlab main
git -C ~/.local/share/gopass/stores/v3 push gitea main

# Verify sync
gopass sync

gopass clone git@github.com:EvanusModestus/gopass-v3.git v3

gopass mounts
# gopass (/home/evanusmodestus/.password-store)
# ├── v2 (/home/evanusmodestus/.local/share/gopass/stores/v2)
# └── v3 (/home/evanusmodestus/.local/share/gopass/stores/v3)

gopass sync
# [v2] OK (no changes)
# [v3] OK (no changes)