Press `Ctrl-C` to stop after observing the result.

====== Test EAP-TEAP (tunneled — two handshakes)

[source,bash]

.What to watch for in debug output
[source,console]

===== Step 4 — Post-Auth Validation (Run in a Second Terminal)

Open a second terminal *before* starting wpa_supplicant. These commands monitor the transaction from multiple vantage points simultaneously.

====== 4a. Local system logs — wpa_supplicant journal

[source,bash]

====== 4b. EAPOL frame activity on the wire

[source,bash]

====== 4c. RADIUS transaction (if switch is sending to ISE)

[source,bash]

====== 4d. Interface state changes

[source,bash]

====== 4e. Kernel audit log (auditd is now active)

[source,bash]

====== 4f. Post-auth checklist (run after CTRL-EVENT-EAP-SUCCESS)

[source,bash]

===== Step 5 — Verify on ISE

After a successful authentication, verify the session from the network side:

[source,bash]

Or check ISE GUI: *Operations → RADIUS → Live Logs* — filter by calling station ID `A8:2B:DD:8F:23:E6`.

===== Step 6 — Compare EAP-TLS vs EAP-TEAP in ISE Logs

After testing both profiles, compare what ISE recorded:

[source,bash]

===== Contingency — Rollback to WiFi

IMPORTANT: Your WiFi connection (`Domus-WiFi-Mgmt-VLAN100` on `wlan0`) remains active during this entire test. The wired test is on a *separate interface* (`enp134s0`). You do not lose connectivity.

====== If wpa_supplicant fails or ISE rejects

[source,bash]

====== If you made it permanent and need to undo

[source,bash]

====== If wired works and you want to switch from WiFi to wired

[source,bash]

====== Emergency: lost all connectivity

[source,bash]

===== Side-by-Side Comparison

[cols="1,1,1"]
|===
| Property | EAP-TLS | EAP-TEAP

| wpa_supplicant `eap=`
| `TLS`
| `TEAP`

| Inner method
| _(none — direct)_
| `phase2="auth=TLS"`

| TLS handshakes
| 1
| 2 (outer tunnel + inner auth)

| Identity privacy
| Exposed in cleartext on the wire
| Encrypted inside outer tunnel

| Same certs?
| Yes
| Yes

| ISE auth log
| `eap_authentication=EAP-TLS`
| `eap_tunnel=TEAP`, `eap_authentication=EAP-TLS`

| RFC
| RFC 5216
| RFC 7170

| Primary use case
| Machine auth, Linux/macOS clients
| Windows BYOD, identity-sensitive environments
|===

===== Step 6 — Make Permanent (After Test Succeeds)

[source,bash]

===== Troubleshooting Quick Reference

[cols="1,2,2"]
|===
| ISE Error Code | Meaning | Fix

| 12514
| EAP-TLS handshake failed
| CA chain not trusted on ISE — import DOMUS-ROOT-CA to ISE trust store

| 12308
| Client cert not found in trust store
| ISE doesn't have the issuing CA — check *Administration → Certificates → Trusted Certificates*

| 12321
| Inner method rejected
| TEAP `phase2` mismatch — verify `auth=TLS` and that Allowed Protocols has TEAP+inner-TLS enabled

| 22056
| TEAP not in allowed protocols
| Add TEAP to the Allowed Protocols list assigned to the policy set

| 22040
| Wrong EAP type
| Client offered an EAP method not in the Allowed Protocols list
|===

.Verify cert chain independently
[source,bash]

===== Config Parameter Reference

[cols="1,2"]
|===
| Parameter | Purpose

| `ctrl_interface=/run/wpa_supplicant`
| Unix socket for `wpa_cli` control — allows runtime queries and profile switching

| `ctrl_interface_group=wheel`
| Group that can access the control socket without root

| `eapol_version=2`
| 802.1X EAPOL frame version — v2 is current standard (v1 for legacy switches)

| `ap_scan=0`
| Wired mode — don't scan for wireless APs, wait for authenticator

| `fast_reauth=1`
| Enable TLS session resumption — faster re-authentication after link flap

| `key_mgmt=IEEE8021X`
| Use 802.1X key management (not WPA-PSK, not open)

| `eapol_flags=0`
| No dynamic WEP keys — wired 802.1X doesn't use per-station encryption

| `phase2="auth=TLS"`
| Inner authentication method inside TEAP tunnel — EAP-TLS (certificate)

| `ca_cert`
| CA chain to validate the RADIUS server's certificate

| `client_cert`
| Your certificate — presented to ISE during EAP-TLS handshake

| `private_key`
| Your private key — proves you own the certificate (never leaves this machine)
|===

==== EAP-TEAP Wired Test — P16g

Testing EAP-TEAP (inner EAP-TLS) on the P16g wired interface against ISE.

===== TEAP Status: Not Available

Arch Linux `wpa_supplicant 2:2.11-5` is compiled **without** `CONFIG_EAP_TEAP=y`. The OpenSSL string found earlier (`Enable cipher suites for anonymous EAP-TEAP provisioning`) is from the OpenSSL library, not the wpa_supplicant EAP module.

[source,bash]

To enable TEAP, rebuild wpa_supplicant from AUR with `CONFIG_EAP_TEAP=y` in the build config. This is a future task — EAP-TLS works and is the production standard.

===== Prerequisites Verified

[cols="1,2,1"]
|===
| Component | Path / Value | Status

| Wired interface
| `enp134s0` (a8:2b:dd:8f:23:e6)
| PASS

| wpa_supplicant
| v2.11 — EAP-TEAP **NOT** compiled in
| ❌ (EAP-TLS works)

| Client cert
| `/etc/ssl/certs/modestus-p16g-eaptls.pem`
| Valid until 2027-04-14

| Private key
| `/etc/ssl/private/modestus-p16g-eaptls.key`
| PASS

| CA chain
| `/etc/ssl/certs/DOMUS-CA-CHAIN.pem`
| DOMUS-ISSUING-CA → DOMUS-ROOT-CA

| ISE allowed protocols
| `Domus_TEAP_TLS_TTLS`
| TEAP enabled

| systemd template
| `wpa_supplicant-wired@.service`
| disabled (available)
|===

===== Step 1 — Write wpa_supplicant Config

[source,bash]

===== Step 2 — Open Debug Terminals (BEFORE Starting wpa_supplicant)

Open these in separate tmux panes or terminal tabs *before* step 3.

.Terminal 2 — wpa_supplicant journal (live)
[source,bash]

.Terminal 3 — EAPOL frames on the wire (802.1X = ethertype 0x888e)
[source,bash]

.Terminal 4 — interface state + IP assignment
[source,bash]

.Terminal 5 — DHCP after port authorization
[source,bash]

.Terminal 6 — NetworkManager events
[source,bash]

.Terminal 7 — auditd syscall trace
[source,bash]

===== Step 3 — Disconnect NetworkManager + Start wpa_supplicant

NetworkManager manages `enp134s0` via the `Domus-Wired-Mgmt-VLAN100` profile (EAP-TLS). You must disconnect NM first — you cannot run two wpa_supplicant instances on the same interface.

[source,bash]

[source,bash]

.Expected — UP or NO-CARRIER (no cable yet)
[source,console]

Once confirmed UP, start wpa_supplicant:

[source,bash]

Watch for:

* `EAP-TEAP: Phase 1 - negotiated` — outer TLS tunnel established
* `EAP-TEAP: Phase 2 - TLS` — inner EAP-TLS handshake
* `CTRL-EVENT-EAP-SUCCESS` — ISE accepted authentication
* `CTRL-EVENT-CONNECTED` — 802.1X port authorized

===== Step 4 — Post-Auth Checklist (After CTRL-EVENT-EAP-SUCCESS)

[source,bash]

===== Step 5 — Verify on ISE Side

[source,bash]

===== Step 6 — Make Permanent (after test succeeds)

[source,bash]

===== Step 7 — Compare EAP-TLS vs EAP-TEAP

After both tests, compare ISE auth logs:

[source,bash]

Key differences to observe:

* **EAP-TLS**: `eap_authentication=EAP-TLS`, no tunnel
* **EAP-TEAP**: `eap_tunnel=TEAP`, `eap_authentication=EAP-TLS` (inner method)
* TEAP provides the tunnel — the same certs, but wrapped in an additional TLS layer

===== Contingency — Rollback to WiFi

WiFi (`Domus-WiFi-Mgmt-VLAN100` on `wlan0`) stays active during the entire wired test — separate interface, separate connection. You cannot lose connectivity.

.If wpa_supplicant fails or ISE rejects
[source,bash]

.If you made it permanent and need to undo
[source,bash]

.Emergency — lost all connectivity
[source,bash]

===== Troubleshooting

====== API Debug — Inspecting HTTP Transactions

These commands show the raw request/response cycle. Essential for diagnosing auth failures, content-type mismatches, and empty responses.

.Show HTTP status code + response body
[source,bash]

.Full TLS handshake + HTTP headers (verbose)
[source,bash]

.Common HTTP status codes from ISE
[cols="1,2,2"]
|===
| Code | Meaning | Fix

| 200
| Success
| Parse the response (XML for MnT, JSON for ERS/OpenAPI)

| 401
| Unauthorized
| Wrong credentials — verify `dsource` loaded the right tier

| 403
| Forbidden
| API user doesn't have MnT admin role in ISE

| 406
| Not Acceptable
| MnT only returns XML — use `Accept: application/xml`, not `application/json`

| 500
| Internal Server Error
| ISE bug or service restart — check ISE admin logs
|===

NOTE: **ISE MnT API returns XML only.** It returns HTTP 406 (Not Acceptable) when you send `Accept: application/json`. The ERS and OpenAPI endpoints return JSON. The `mnt()` function in `ise-common.sh` now uses `Accept: application/xml` and pipes through `yq -p xml -o json` for conversion.

====== EAP Failure Debugging

If `CTRL-EVENT-EAP-FAILURE`:

[source,bash]

If wpa_supplicant hangs at `EAP-TEAP: Phase 1`:

[source,bash]

====== Live System Diagnostics

.wpa_supplicant activity (last 2 minutes)
[source,bash]

.All sudo commands during this test
[source,bash]

.NetworkManager events (interface state changes)
[source,bash]

.auditd — every process wpa_supplicant spawned
[source,bash]

.DHCP client activity (did we get an IP after port authorization?)
[source,bash]

.Kernel messages (link state changes, driver errors)
[source,bash]

==== EAP-TLS Wired Test Results — 2026-06-21

First successful wired 802.1X EAP-TLS authentication on the P16g.

===== Test Outcome

[cols="1,2"]
|===
| Component | Result

| wpa_supplicant EAP-TLS handshake
| ✅ SUCCESS — `selectedMethod=13 (EAP-TLS)`

| Certificate chain validation
| ✅ DOMUS-ROOT-CA → DOMUS-ISSUING-CA → ise-01.inside.domusdigitalis.dev

| TLS cipher
| `ECDHE-RSA-AES256-GCM-SHA384` (TLSv1.2)

| IP assignment
| 10.50.1.203/24 via DHCP

| Gateway reachable
| ✅ 10.50.1.1 — 0.4ms RTT

| ISE RADIUS session
| FAILt visible — switch port in open/monitor mode

| NAS (switch)
| LAB-3560CX-01 (10.50.1.10) — Gi1/0/3

| Port description
| `[DOT1X] AIR-AP4800-B-K9` — provisioned for AP, not workstation
|===

===== Network Path Discovery

.LLDP capture — identify switch and port
[source,bash]

.ARP neighbor — identify gateway device
[source,bash]

.Results
[cols="1,2"]
|===
| Discovery | Value

| Switch
| LAB-3560CX-01 (`9c:57:ad:48:a3:80`)

| Port
| Gi1/0/3

| Port template
| `[DOT1X]` — 802.1X configured

| Original purpose
| AIR-AP4800-B-K9 (AP port)

| Switch IP
| 10.50.1.10

| Switch IOS
| C3560CX-UNIVERSALK9-M 15.2(7)E2

| PVID
| 100 (management)

| Gateway
| 10.50.1.1 (`52:54:00:ac:44:8d` — VyOS KVM)

| ISE NAD name
| Home-3560CX-01 (registered in ISE ERS)
|===

===== Intel igc Driver — PTM Timeout Workaround

The P16g's Intel I225/I226 NIC (`igc` driver) fails to initialize with `Timeout reading IGC_PTM_STAT register`. Workaround:

[source,bash]

`COMMAND=0x06` sets Bus Master Enable + Memory Space Enable — normal NIC operation. No security risk. This is a driver bug workaround, not a security bypass.

.Kernel messages showing the PTM timeout
[source,console]

===== EAP-TLS Journal Output

[source,console]

===== wpa_cli Status (Post-Auth)

[source,console]

===== Network Connection Status (Post-Auth)

[source,console]

Both WiFi and wired active simultaneously — contingency path confirmed.

===== Why ISE Has No Session

The 3560CX port Gi1/0/3 has a `[DOT1X]` template but is likely in **open mode** or **monitor mode**:

* **Open mode** (`authentication open`): switch forwards traffic regardless of auth result. wpa_supplicant completes EAP, but the switch doesn't enforce the result and may not send RADIUS accounting.
* **Monitor mode** (`authentication host-mode multi-auth` with no enforcement): similar — auth happens but isn't enforced.

The port was originally provisioned for an AP (`AIR-AP4800-B-K9`), which typically uses MAB, not closed-mode dot1x.

===== Switch-Side Verification (IBNS 2.0)

SSH to the 3560CX requires legacy key exchange (IOS 15.2):

[source,bash]

====== Port config — Gi1/0/3 (where P16g is connected)

[source,console]

====== Access session — dot1x SUCCESS

[source,console]

====== dACL pushed by ISE

[source,console]

====== ISE authorization policy matched

The dACL `DACL_ADMIN_FULL` maps to `Domus_Admin_Profile`. From the OpenAPI policy hierarchy:

[source,console]

The authz rule `Domus_Cert_Admin_P16g` matched the certificate CN `modestus-p16g.inside.domusdigitalis.dev` and pushed:

* VLAN 100 (management)
* dACL: `permit ip any any` (full admin access)
* Session timeout: 8 hours with reauthenticate

====== RADIUS server stats

[source,console]

====== dot1x template bound ports

[source,console]

===== ISE MnT Discovery: Wired Sessions Not in ActiveList

The MnT `ActiveList` API returned only wireless sessions (NAS 10.50.1.40 = WLC). The wired session through the 3560CX (10.50.1.10) does not appear despite the switch confirming RADIUS success and dACL push.

MnT `auth-history` by MAC also returned empty for the wired MAC. This may be a MnT indexing limitation for wired NADs or a delay in the MnT database.

The switch-side `show access-session` is the authoritative source for wired 802.1X session state.

===== ISE MnT API — Key Discoveries

[cols="1,2"]
|===
| Discovery | Detail

| MnT returns XML only
| HTTP 406 on `Accept: application/json` — use `application/xml` + `xq '.'` for JSON conversion

| CoA uses GET not POST
| POST returns 405. GET with PSN short hostname works.

| PSN must be short hostname
| `ise-01` not `ise-01.inside.domusdigitalis.dev` — from `acs_server` field in session detail

| ISE error 34110
| "Incorrect PSN information" = you passed NAS IP or FQDN where ISE expected PSN short hostname

| ActiveList may exclude wired
| Wired sessions through 3560CX not visible in MnT ActiveList — use `show access-session` on switch
|===

===== Switch Commands Quick Reference (IBNS 2.0)

[source,console]

===== Next Steps

1. Test EAP-TEAP on the same port — swap wpa_supplicant config
2. Compare ISE auth logs: EAP-TLS vs EAP-TEAP via DataConnect
3. Remove ise-02 (10.50.1.21) from RADIUS server config — decommissioned
4. Investigate MnT ActiveList wired session gap

===== Utility Scripts Created

.nmcli connection status
[source,bash]

.Network path discovery (alternative to lldpctl and arp)
[source,bash]

=== Personal Infrastructure

==== P16g Lid-Wake Black Screen — Evidence Gathering

Recurring issue: laptop wakes from lid-open but internal display stays black. External monitor shows hyprlock and works. Third consecutive day observed (2026-06-19, 2026-06-20, 2026-06-21).

.Root cause (from CR-2026-06-19-p16g-hyprlock-lid-wake)
The lid switch bindings use `hyprctl keyword monitor "eDP-1, disable"` which tears down the i915 DRM display pipe on Arrow Lake-S. The driver cannot reliably re-initialize it on lid open. `hypridle` already avoids this pattern by using `brightnessctl` instead.

.Status
* [x] CR exists: xref:case-studies/changes/CR-2026-06-19-p16g-hyprlock-lid-wake/index.adoc[CR-2026-06-19]
* [x] Evidence partial added to CR — 6 evidence items documenting the broken state
* [ ] Run evidence commands to capture live proof before applying fix
* [ ] Apply fix (Phase 1-3 from implementation partial)
* [ ] Run verification tests (5 functional tests from verification partial)

.Evidence commands to run
[source,bash]

.Apply fix (after evidence confirmed)
[source,bash]

==== SSH Config — Activate Modular Architecture

Discovered dangling symlink: `~/.ssh/config` points to `dots-quantum/ssh/.ssh/config` which doesn't exist. The restructured config was built yesterday as `config.new` but never renamed.

===== What was built (2026-06-20)

Monolithic SSH config replaced with modular `Include`-based architecture:

This fixes the RCA root cause structurally — `00-exceptions.conf` loads before `Host *` by sort order. Ordering can't break again.

===== Initial state (broken — two issues discovered)

[source,bash]

===== Fix — four steps

.Step 1: Rename config.new → config (restores the dangling symlink)
[source,bash]

.Step 2: Populate 80-d000-hosts.conf from DNS (full 45-host zone)
[source,bash]

.Step 3: Verify ALL hosts resolve to IPs (not just aliases)
[source,bash]

.Expected output (all GOOD — hosts that resolve from DNS)

NOTE: `ssh -G` reads the config and prints resolved values WITHOUT connecting. If any host shows BAD, its entry is missing from `80-d000-hosts.conf`.

.Step 4: Test connection
[source,bash]

===== Post-activation — encrypt and commit

After verifying `ssh -G kvm-01 | awk '/^hostname/'` returns an IP:

.Step 1: Re-encrypt 80-d000-hosts.conf (delete stale .age first)
[source,bash]

.Step 2: Encrypt the main config
[source,bash]

.Step 3: Commit to dots-quantum
[source,bash]

.Step 4: Verify round-trip (decrypt and diff)
[source,bash]

===== Fix: Network device patterns missing from 30-cisco-defaults.conf

`9800-wlc-01` SSH failed with `Permission denied` — the host matched `80-d000-hosts.conf` (IP resolved) but fell through to `Host *` (PasswordAuthentication no) because `30-cisco-defaults.conf` only matched `wlc-*`, not `9800-wlc-*`.

.Before
[source,bash]

.Change — add all network device prefixes from zone dump
[source,bash]

.After
[source,bash]

.Verify — should show user=admin, passwordauthentication=yes
[source,bash]

===== Why this happened

Not a design failure. The architecture is correct — modular `Include`, numbered sort order, encrypted host mappings. Three things were left unfinished during the migration:

1. `config.new` was never renamed to `config` — dangling symlink
2. `80-d000-hosts.conf` was empty — host→IP mappings were never migrated from the old monolithic config
3. Host names existed in `20-d000-key-hierarchy.conf` (key assignment) but had no corresponding `HostName` entries with IPs

The fix used a `dig` loop to generate the host mappings directly from DNS — turning the BIND zone data into SSH config entries. This is better than manually copying IPs from the old config because it's verifiable against the authoritative source.

===== Setup on a new machine (from `git pull`)

The entire SSH config is portable via `dots-quantum`. On any new machine:

[source,bash]

.What stow creates

.What git tracks (only encrypted files)

.What is gitignored (plaintext with secrets)

.Prerequisites on the new machine
* `age` installed — for decryption
* `~/.age/identities` — your age private key (never in git, transfer via secure channel)
* `stow` installed — for symlink management
* `openssh >= 9.0` — for Post-Quantum KEX support

The pattern: **git tracks encrypted files, stow creates symlinks, age decrypts on each machine.** The plaintext never enters git. Every machine gets the same config from one `git pull` + two `age -d` commands.

===== Related

* xref:case-studies/rca/ssh-config-order/index.adoc[RCA-2026-03-16-002: SSH Config Order] — original root cause (Host * before exceptions)
* The modular architecture is the permanent fix for that RCA

==== BIND Essentials — DNS Checks and Automation

Essential BIND commands for zone management, record verification, and health checks. All commands run from the workstation unless noted.

===== Zone Dump — See EVERYTHING in DNS

The authoritative way to find every host. No guessing, no loops — the zone file is the source of truth.

.Full zone transfer (AXFR) from primary
[source,bash]

.Extract just A records — clean table, trailing dot stripped, sorted by IP
[source,bash]

Why this version is better than `awk '/\tA\t/'`:

* `+noall +answer` — suppresses headers, only answer section (cleaner input to awk)
* `$4=="A"` — exact field match on record type, not a regex that could false-positive on AAAA or TXT containing "A"
* `sub(/\.$/,"",h)` — strips the trailing dot from FQDNs (DNS wire format → human-readable)
* `sort -k2,2V` — version sort on IP field (10.50.1.2 before 10.50.1.10, not lexicographic)

.Count total A records
[source,bash]

.Zone dump output (2026-06-21 — 45 A records from bind-02)

NOTE: AXFR must be allowed from your IP in BIND's `named.conf`. If it fails with `Transfer failed`, you need to run it from bind-01/bind-02 directly or add your workstation IP to the `allow-transfer` ACL.

===== On-Server Commands (run via SSH)

.Check zone file syntax before reload
[source,bash]

.Check named.conf syntax
[source,bash]

.Reload zone after edits (no restart needed)
[source,bash]

.Check zone serial numbers (primary vs secondary)
[source,bash]

Same serial = zone transfer is current. Different = stale secondary.

.Force zone transfer to secondary
[source,bash]

===== Health Checks (from workstation)

.Verify both servers respond
[source,bash]

.Check for stale/missing PTR records (reverse DNS)
[source,bash]

.Compare SSH config hosts against DNS (find gaps)
[source,bash]

===== Service Status (via SSH)

[source,bash]

===== Quick Reference

[cols="1,2"]
|===
| Task | Command

| Resolve a host
| `dig +short hostname.inside.domusdigitalis.dev @10.50.1.90`

| Reverse lookup
| `dig +short -x 10.50.1.110 @10.50.1.90`

| Full zone dump
| `dig axfr inside.domusdigitalis.dev @10.50.1.90`

| Zone syntax check
| `ssh bind-01 sudo named-checkzone zone /path/to/zone.file`

| Config syntax check
| `ssh bind-01 sudo named-checkconf`

| Reload zone
| `ssh bind-01 sudo rndc reload inside.domusdigitalis.dev`

| Force zone transfer
| `ssh bind-01 sudo rndc notify inside.domusdigitalis.dev`

| Check serial match
| `dig SOA zone @primary +short` vs `dig SOA zone @secondary +short`

| Service status
| `ssh bind-01 systemctl is-active named`
|===

==== Age Key Mismatch — Two Keypairs, Wrong One Used

Discovered during SSH config activation: `age -e -R ~/.age/recipients/self.txt` encrypts to a DIFFERENT keypair than `encrypt-file`/`decrypt-file` use.

===== The Two Keypairs

[cols="1,2,2"]
|===
| Keypair | Public Key (truncated) | Used By

| **Personal**
| `age1u2hgwz...xcr3l`
| `~/.age/recipients/self.txt`, manual `age -e -R` commands

| **Master**
| `age1wtdeue...jqcnn`
| `encrypt-file`, `decrypt-file`, `d001 open/close`
|===

.Key file locations

===== What Went Wrong

The ssh-config-activation partial used:
[source,bash]

`decrypt-file` then fails with `no identity matched any of the recipients` because it uses `master.age.key` which is a different keypair.

===== The Rule

**Always use `encrypt-file`/`decrypt-file`** — they use the correct key (`master.age.key`/`master.age.pub`).

If you MUST use raw `age` commands (e.g., no access to the scripts):

[source,bash]

NEVER use `-R ~/.age/recipients/self.txt` — that encrypts to the personal key, which `decrypt-file` cannot open.

===== How to Verify Key Match

[source,bash]

If `self.txt` matches `personal` but your tools use `master` — that's the mismatch.

===== Open Question

Should `self.txt` be updated to point to the master key? That would align manual `age -e -R self.txt` with `encrypt-file`. But it would break decryption of any files previously encrypted to the personal key. Needs a full audit of which files are encrypted to which key before changing.

[source,bash]

===== Automated Verification — `find` + Process Substitution

No hardcoded paths. `find` locates every file dynamically:

.Round-trip verification (decrypt .age, diff against plaintext)
[source,bash]

.SSH host resolution check
[source,bash]

This pattern works from ANY directory — `find` resolves the paths, process substitution feeds them to `diff` and `age`. No `cd`, no hardcoded paths, no assumptions about working directory.

===== Commands to Diagnose (reference)

[source,bash]

// Concern: gopass v3 store — gitea remote hostname mismatch fix
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/gopass-gitea-remote-fix.adoc

==== gopass v3 — Gitea Remote Hostname Fix

`gopass sync` failed pushing to the gitea remote:

[source,console]

===== Root Cause

The v3 store's `origin` had three push URLs. The gitea URL used bare `gitea` as the hostname, but SSH config defines `Host gitea-01` (not `gitea`):

.Before — broken
[source,console]

SSH config (`~/.ssh/config.d/80-d000-hosts.conf`) has `Host gitea-01` pointing to `10.50.1.70` — no `Host gitea` alias exists.

===== Fix Applied

Replace the broken push URL with one matching the SSH config hostname:

[source,bash]

.After — fixed
[source,console]

===== Why Option A Over Option B

Adding an SSH alias (`Host gitea → 10.50.1.70`) would also fix the resolution, but creates a second name for the same host. The SSH config already uses `gitea-01` consistently — a bare `gitea` alias introduces naming drift that surfaces later as a "which hostname is correct?" debugging session.

Fix the remote URL to match the existing SSH config. Don't add SSH aliases to paper over inconsistent git remotes.

===== Phase 2 — SSH Key for Gitea

After fixing the remote URL, `gopass sync` connected to `10.50.1.70` but got `Permission denied (publickey)`. The SSH config for `gitea-01` had no `IdentityFile` — SSH tried default key names, none of which exist. The gitea key is `~/.ssh/id_ed25519_gitea`.

.Diagnose — see which keys SSH offers
[source,bash]

.Step 1: Verify before — current state
[source,bash]

Expected: `Host gitea-01` with `HostName 10.50.1.70`, no `IdentityFile`.

.Step 2: Change — add IdentityFile via sed
[source,bash]

.Step 3: Verify after — confirm the insertion
[source,bash]

Expected:

.Step 4: Test SSH — confirm the key is offered
[source,bash]

Should show `Offering public key: /home/evanusmodestus/.ssh/id_ed25519_gitea` and `Authenticated`.

===== Phase 3 — SSH Port Mismatch (2222 vs 22)

After fixing hostname and key, `gopass sync` still failed with `Permission denied`. The key was offered but gitea rejected it — because gitea's Docker SSH listener runs on port `2222`, not the default `22`.

.Diagnose — query gopass for the SSH port
[source,bash]

Output:

The git remote `git@gitea-01:...` uses port 22. Gitea listens on 2222.

.Diagnostic trail — gopass entries queried to find the port
[source,bash]

.Step 1: Verify before — current SSH config
[source,bash]

.Step 2: Change — add Port 2222 via sed
[source,bash]

.Step 3: Verify after — confirm the insertion
[source,bash]

Expected:

.Step 4: Test SSH on port 2222
[source,bash]

.Step 5: Update git remote URL — SSH with non-standard port uses `ssh://` syntax
[source,bash]

NOTE: `git@host:path` syntax always uses port 22. For non-standard ports, you must use `ssh://git@host:port/path` syntax.

.Step 6: Test gopass sync — confirm all three remotes push
[source,bash]

All three push targets (GitHub, GitLab, Gitea) should succeed.

.Step 7: Encrypt — delete stale .age, re-encrypt, verify round-trip
[source,bash]

.Step 7: Commit — only the .age file
[source,bash]

===== Verification

[source,bash]

All three push targets (GitHub, GitLab, Gitea) should succeed.

===== Commands Learned

[cols="1,2"]
|===
| Command | What It Does

| `git remote get-url --push --all origin`
| List all push URLs for a remote — reveals multi-push configurations

| `git remote set-url --delete --push origin 'url'`
| Remove a specific push URL without affecting fetch or other push URLs

| `git remote set-url --add --push origin 'url'`
| Add a new push URL — origin pushes to multiple remotes

| `git -C path`
| Run git in a different directory without `cd` — cleaner than `cd && git && cd -`
|===

// Concern: Multi-remote git push — add GitLab + Gitea to all repos, parallel push
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/multi-remote-push.adoc

==== Multi-Remote Git Push — GitHub + GitLab + Gitea

===== Add Push URLs to a Single Repo

When `origin` only has GitHub, add GitLab and Gitea as push targets.
The first `--add --push` must re-add GitHub — creating an explicit push list replaces the implicit fetch-as-push.

.Verify before
[source,bash]

.Add all three push URLs
[source,bash]

.Verify after — should show 1 fetch, 3 push
[source,bash]

Expected:

.Test push
[source,bash]

NOTE: Confirm the repo exists on each remote before pushing. For gitea: `https://10.50.1.70:3000/evanusmodestus/dots-quantum`. Create it in the browser if it doesn't exist.

===== Add Push URLs to ALL Repos in a Directory

Loop over every git repo under `~/atelier/` and add the missing push URLs.

.Audit — show which repos only push to GitHub
[source,bash]

.Add GitLab + Gitea to repos that only have GitHub
[source,bash]

===== Parallel Push — All Repos at Once

.Push every repo under ~/atelier in parallel
[source,bash]

`-P4` runs 4 pushes in parallel. `-print0`/`-0` handles paths with spaces.

.Push specific repos only — brace expansion
[source,bash]

`&` backgrounds each push, `wait` blocks until all finish. Simple parallel without xargs.

.Verify all remotes across all repos
[source,bash]

===== Key Rules

[cols="1,2"]
|===
| Rule | Why

| `git@host:path` syntax
| Always uses port 22 — cannot specify a different port

| `ssh://git@host:port/path` syntax
| Required for non-standard SSH ports (gitea on 2222)

| First `--add --push` must re-add the original
| Creating an explicit push list replaces the implicit fetch-as-push URL

| `git -C path` not `cd path && git`
| Cleaner, no directory state to manage, works in loops

| `& + wait` for parallel push
| Simpler than xargs when repos are known by name

| `-P4` xargs for parallel push
| Better when discovering repos via `find`
|===

// Concern: Gitea API — repo creation via curl + dsec + jq
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/gitea-api-repo-creation.adoc

==== Gitea API — Repo Creation from CLI

===== General API Wrapper

Terminal paste breaks multi-line curl. This wrapper script solves it permanently — every API call becomes `bash /tmp/gitea-api.sh <endpoint> | jq <filter>`.

.Create the wrapper
[source,bash]

===== General API Queries

.Your profile
[source,bash]

.List all repos — names only
[source,bash]

.Query a specific repo
[source,bash]

.Get SSH URL for git remote config
[source,bash]

.Table format — name, SSH URL, visibility
[source,bash]

.Count total repos
[source,bash]

.Save full response to file for later inspection
[source,bash]

.Query from saved file (no API call needed)
[source,bash]

===== Load Credentials

[source,bash]

===== Create a Single Repo

Terminal paste breaks multi-line curl. Write to a script file instead.

.Create repo script
[source,bash]

.Usage — create a single repo
[source,bash]

.Parse the response with jq
[source,bash]

===== Query Repos — Inspect Before Creating

.List all your repos on gitea
[source,bash]

.List with full names
[source,bash]

.Table format — name, SSH URL, visibility
[source,bash]

.Query a specific repo — check if it exists
[source,bash]

.Get just the SSH URL — for git remote configuration
[source,bash]

.Count total repos
[source,bash]

.Error handling — detect "already exists"
[source,bash]

Returns `The repository with the same name already exists.` or `success`.

===== Diff Local vs Gitea — Find Missing Repos

.Show which local repos are NOT on gitea yet
[source,bash]

`comm -23` shows lines only in the first file (local but not on gitea).

===== Bulk Create — All Repos from ~/atelier

.Dry run — show which repos would be created
[source,bash]

.Create all missing repos on gitea
[source,bash]

NOTE: `?` is a glob character in zsh. Always quote endpoints containing `?`: `'/user/repos?limit=50'` not `/user/repos?limit=50`.

===== jq Patterns for API Responses

[cols="1,2"]
|===
| Pattern | What It Does

| `jq .`
| Pretty-print full JSON response

| `jq '{name, ssh_url}'`
| Extract specific fields into a new object

| `jq -r '.ssh_url'`
| Raw output — no quotes, pipe-friendly

| `jq -r '.[] \| .name'`
| Iterate array, extract one field per line

| `jq -r '.[] \| [.name, .ssh_url] \| @tsv'`
| Array → tab-separated values for `column -t`

| `jq -e '.id'`
| Exit code 0 if field exists, 1 if null — use in conditionals

| `jq -r '.message // "unknown"'`
| Alternative operator — fallback if field is null
|===

===== Cleanup

[source,bash]

// Concern: Gitea TLS cert renewal — expired cert with wrong CN
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/gitea-cert-renewal.adoc

==== Gitea TLS Certificate Renewal

===== Problem

Gitea's TLS cert expired 2026-04-14 and has the wrong CN:

[source,console]

Two issues:

1. **Expired** — over 2 months past `notAfter`
2. **Wrong CN** — `guest.domusdigitalis.dev` instead of `gitea-01.inside.domusdigitalis.dev`

Impact: `git push gitea` via LFS fails TLS validation. Currently bypassed with:

[source,bash]

===== Vault PKI — Load Credentials and Discover Roles

.Source Vault credentials
[source,bash]

.Verify Vault is reachable
[source,bash]

.List PKI mounts
[source,bash]

Output:

.List available roles
[source,bash]

Output:

.Inspect the server role — check allowed domains, max TTL
[source,bash]

===== Issue New Certificate

.Issue cert with correct CN and SAN
[source,bash]

.Inspect the response structure
[source,bash]

Response is nested: top-level has `data`, `lease_duration`, `request_id`, `warnings`.
Cert fields live under `.data`: `certificate`, `private_key`, `ca_chain`, `serial_number`, `expiration`.

.Extract cert, key, and CA chain to files
[source,bash]

.Verify the cert before deploying
[source,bash]

Expected: CN=gitea-01.inside.domusdigitalis.dev, valid for 1 year, SAN includes 10.50.1.70.

===== Deploy to Gitea (NAS Docker)

.Discovery — how the cert paths were found
[source,bash]

Cert paths (container → host):

.Copy certs from workstation to NAS (scp fails — use cat | ssh tee)
[source,bash]

NOTE: Requires `sudo mkdir -p /volume1/tmp && sudo chmod 777 /volume1/tmp` on the NAS first.

.Deploy certs on NAS (run from NAS SSH session)
[source,bash]

===== Verify After

.Check new cert from workstation
[source,bash]

Expected: `CN=gitea-01.inside.domusdigitalis.dev`, `notAfter` ~1 year from now.

.Gitea with renewed TLS certificate — valid CN in browser
image::screenshots/infrastructure/gitea-cert-renewed-2026-06-21.png[Gitea login with valid TLS cert,width=100%]

.Test git push without TLS skip
[source,bash]

.Test API
[source,bash]

===== Cleanup

.From NAS SSH session
[source,bash]

.From workstation
[source,bash]

.Rotate exposed gitea PAT token

===== Prevention

This cert expired because there was no automated renewal for gitea.
Add to ACME cert automation project — gitea should renew via the same Vault+certbot pipeline as ISE.

===== Related

* ACME cert automation project — POC complete for ISE, extend to gitea
* gopass-gitea-remote-fix — the hostname and SSH key fixes that preceded this

// Concern: Vault SSH certificate renewal — expired cert blocking NAS access
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/vault-ssh-cert-renewal.adoc

==== Vault SSH Certificate Renewal

===== Problem

SSH to NAS and other infrastructure hosts failed with `Too many authentication failures`. Root cause: the Vault-signed SSH certificate expired 9 days ago. It had an 8-hour TTL and was never renewed.

.Diagnose — check cert validity
[source,bash]

Output (expired):

Two problems: expired (June 12), and empty Principals (no usernames authorized).

===== Discovery — Vault SSH Mount and Role

.Source Vault credentials
[source,bash]

.Find the SSH secrets engine
[source,bash]

Output: `ssh/` mount with `ssh_d682fece` accessor.

.List SSH roles
[source,bash]

Output: `domus-client` and `domus-host`.

.Inspect the client signing role
[source,bash]

Output:

===== Renew — Sign the Public Key

.Sign with Vault (overwrite expired cert)
[source,bash]

NOTE: `>|` forces overwrite — zsh `noclobber` blocks `>` on existing files.

.Verify — must show future expiry and principals
[source,bash]

Expected:

.Test SSH
[source,bash]

===== Daily Renewal — Shell Alias

The cert has an 8-hour TTL. Renew at the start of each session.

.Add to ~/.zshrc or ~/.zshenv
[source,bash]

.Usage
[source,bash]

Sources Vault credentials, signs the key, verifies, unsources — one command.

===== Automated Renewal — systemd Timer

For hands-free renewal, a systemd user timer that runs every 7 hours (before the 8h expiry).

.Create the service unit
[source,bash]

.Create the timer unit
[source,bash]

.Enable and start
[source,bash]

.Manual trigger
[source,bash]

===== Why 8 Hours

Short-lived certificates are the security model — if a cert is compromised, the exposure window is 8 hours max. The tradeoff: you must renew daily. The shell alias makes this a single command; the systemd timer makes it automatic.

===== NAS-Specific Notes

* NAS SSH username is `adminerosado` (not `evanusmodestus`) — the cert must include this principal
* `MaxAuthTries` on the NAS is low — when the cert expires, SSH offers it first, it fails, and the remaining key offers exhaust the retry limit
* Password fallback: `ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -l adminerosado nas-01`
* NAS password: `gopass show -c v3/domains/d000/storage/nas-01/admin`

// Concern: YubiKey 5C NFC setup — duplicate credentials from existing key
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/yubikey-5c-nfc-setup.adoc

==== YubiKey 5C NFC — New Key Setup

New YubiKey 5C NFC purchased. Goal: duplicate credentials from existing YubiKey so both keys work interchangeably as primary/backup pair.

===== Inventory — Current Keys

.List connected YubiKeys
[source,bash]

Output (2026-06-21):

.Assign serials to variables — use throughout session
[source,bash]

.Check device info on each — --device selects by serial
[source,bash]

.Compare both keys side by side — process substitution + diff
[source,bash]

Only difference: serial and firmware (5.7.1 vs 5.7.4). All applications identical — both keys are ready for credential setup.

.Compare FIDO2 credentials — what the old key has that the new one needs
[source,bash]

.Compare OATH accounts
[source,bash]

.Compare PIV slots
[source,bash]

===== Automated Discovery — No Hardcoded Serials

.Extract serials into an array from ykman output
[source,bash]

.Loop over all connected keys — info for each
[source,bash]

.Auto-diff two keys (no hardcoded serials)
[source,bash]

.Full audit — info, FIDO2, OATH, PIV for every connected key
[source,bash]

.Diff FIDO2 credentials between first and second key
[source,bash]

.Diff OATH accounts
[source,bash]

The pattern: `awk -F'Serial: ' '{print $2}'` splits on `Serial: ` and grabs the number. The array holds however many keys are plugged in — scales to 2, 3, or more without editing the script.

===== Pre-Setup — What Needs Duplication

[cols="1,2,2"]
|===
| Credential Type | Source (Existing Key) | Action for New Key

| FIDO2 SSH keys
| `id_ed25519_sk_rk_d000_nano`, `id_ed25519_sk_rk_d000`, `id_ed25519_sk_rk_d000_secondary`
| Generate new resident keys, add pubkeys to all hosts

| GPG (gopass)
| GPG subkeys on existing YubiKey
| Move copies of subkeys to new YubiKey (requires backup)

| FIDO2 WebAuthn
| GitHub, GitLab, Gitea, etc.
| Register new key as additional security key per site

| PIV
| If used for any certs
| Check: `ykman piv info`

| OATH/TOTP
| Any TOTP seeds
| Check: `ykman oath accounts list`
|===

===== Step 1 — Set PINs on New Key

.Set FIDO2 PIN
[source,bash]

.Set PIV PIN (if using PIV)
[source,bash]

===== Step 2 — FIDO2 SSH Resident Keys

Generate new SSH keys on the new YubiKey. These are *new* keys — FIDO2 private keys cannot be exported from one YubiKey to another. Both keys' public keys must be added to `authorized_keys` on every host.

.Generate resident key on new YubiKey
[source,bash]

.Verify the key
[source,bash]

.Add to SSH config — update 20-d000-key-hierarchy.conf
[source,bash]

===== Step 3 — Deploy Public Key to All Hosts

.Copy pubkey to infrastructure hosts
[source,bash]

NOTE: NAS requires `ssh-copy-id -o PreferredAuthentications=password -o PubkeyAuthentication=no -o User=adminerosado` since key auth uses the vault cert.

===== Step 4 — GPG Subkeys (for gopass)

FIDO2 keys are per-device. GPG keys *can* be duplicated — but only from a backup, not from another YubiKey. The private key on a YubiKey is non-exportable.

.Check if you have a GPG key backup
[source,bash]

.If backup exists — import to new YubiKey
[source,bash]

WARNING: `keytocard` is one-way — it moves the key OFF the local keyring onto the YubiKey. Always work from a backup copy, never the only copy.

===== Step 5 — WebAuthn Registration

Register the new YubiKey as an additional security key on each service. This is a browser operation — cannot be automated.

* GitHub: Settings → Security → Security keys → Add
* GitLab: Settings → Account → Two-factor → Register new device
* Gitea: `https://10.50.1.70:3000/user/settings/security` → Add Security Key

===== Step 6 — OATH/TOTP (if applicable)

.Check existing TOTP accounts
[source,bash]

TOTP seeds must be added individually to the new key — they cannot be cloned. Re-scan QR codes or use backup seeds stored in gopass.

===== Verification

.Test SSH with new YubiKey (remove old key, insert new)
[source,bash]

.Test gopass with new YubiKey
[source,bash]

.List all resident keys on new YubiKey
[source,bash]

===== ykman Quick Reference

[cols="1,2"]
|===
| Command | What It Does

| `ykman list`
| List connected YubiKeys

| `ykman info`
| Device info — serial, firmware, interfaces

| `ykman fido info`
| FIDO2 status — PIN set, credentials count

| `ykman fido credentials list`
| List resident keys (FIDO2)

| `ykman fido access change-pin`
| Set or change FIDO2 PIN

| `ykman oath accounts list`
| List TOTP/HOTP accounts

| `ykman oath accounts code`
| Generate all TOTP codes

| `ykman oath accounts code <name>`
| Generate code for specific account

| `ykman piv info`
| PIV slot status

| `ykman config usb`
| Enable/disable USB interfaces (OTP, FIDO2, PIV, etc.)
|===

=== Education

==== Reading .xlsx Files with Python openpyxl

How to read Excel spreadsheets from the command line using Python's `openpyxl` library. Used to extract the CHLA annual review structure without opening Excel or LibreOffice.

===== Why openpyxl

`.xlsx` is a ZIP archive of XML files. `openpyxl` parses the XML and exposes cells, formulas, sheets, and formatting as Python objects. It's the standard library for Excel manipulation in Python — no Excel installation needed.

===== Setup — Temporary Virtual Environment

Arch Linux enforces PEP 668 — you can't `pip install` into the system Python. Use a temporary venv:

[source,bash]

The venv lives in `/tmp/` — it's disposable. Recreate it after reboot.

===== Set the Target File (Do This First)

Every command below uses `$XLSX`. Set it once:

[source,bash]

===== Dump All Cells to File

[source,bash]

Then search the dump:

[source,bash]

===== Read a Single Cell (Full Content)

[source,bash]

===== Read a Single Cell from Any Sheet

[source,bash]

===== Summary Table (All SelfEval Cells)

[source,bash]

===== Edit a Cell

[source,bash]

===== Edit Multiple Cells in One Pass

[source,bash]

===== Dump to JSON (for jq Processing)

[source,bash]

===== Read Leader Ratings (From LeaderReview Sheet)

[source,bash]

===== Key Concepts

[cols="1,2"]
|===
| Concept | Code

| Load workbook
| `wb = openpyxl.load_workbook('file.xlsx')`

| List sheets
| `wb.sheetnames` → `['SelfEval', 'LeaderReview']`

| Select sheet
| `ws = wb['SelfEval']`

| Read single cell
| `ws['C32'].value` → `'Evan Rosado'`

| Read cell by row/col
| `ws.cell(row=32, column=3).value`

| Iterate all rows
| `ws.iter_rows(values_only=True)` → tuples of values

| Iterate with cell objects
| `ws.iter_rows(values_only=False)` → tuples of Cell objects

| Cell coordinate
| `cell.coordinate` → `'D32'`

| Cell row/column
| `cell.row` → `32`, `cell.column` → `4`

| Sheet dimensions
| `ws.max_row`, `ws.max_column`

| Merged cells
| `ws.merged_cells.ranges`
|===

===== PEP 668 — Why pip install Fails on Arch

Arch Linux marks the system Python as "externally managed" per PEP 668. Direct `pip install` is blocked to prevent breaking system packages.

[cols="1,2"]
|===
| Method | When to Use

| `python3 -m venv /tmp/env`
| Quick throwaway work (this session)

| `pipx install tool`
| CLI tools you want permanently

| `pacman -S python-openpyxl`
| If the package exists in Arch repos

| `--break-system-packages`
| Never. It's there for a reason.
|===

===== openpyxl vs Other Libraries

[cols="1,1,2"]
|===
| Library | Format | Use Case

| `openpyxl`
| `.xlsx` (Excel 2010+)
| Read/write modern Excel files

| `xlrd`
| `.xls` (legacy Excel)
| Read old Excel 97-2003 files

| `pandas`
| `.xlsx`, `.csv`, `.xls`
| DataFrames, analysis, pivot tables (heavyweight)

| `csv`
| `.csv`
| stdlib — no install needed

| `xlsxwriter`
| `.xlsx`
| Write-only, better formatting than openpyxl
|===

For reading HR forms like the annual review, `openpyxl` is the right tool — lightweight, no pandas overhead, direct cell access.

==== lsof — Session and Connection Management

`lsof` (List Open Files) is the universal diagnostic tool on Linux. Every socket, pipe, file handle, and network connection is a file descriptor — `lsof` shows them all. This is the hammer.

===== Kill Stuck SSH Sessions

[source,bash]

===== Network Connections — Who's Talking to What

[source,bash]

NOTE: `-n` = don't resolve hostnames (faster), `-P` = don't resolve port names (show numbers).

===== Process File Handles — What Does This Process Have Open?

[source,bash]

===== Port Conflicts — Who's Holding That Port?

[source,bash]

===== File Lock Investigation — Why Can't I Write?

[source,bash]

===== Deleted Files Still Consuming Disk

[source,bash]

===== Unix Sockets — IPC Investigation

[source,bash]

===== Combine with kill — Patterns

[source,bash]

===== Combine with watch — Live Monitoring

[source,bash]

===== Real-World Scenarios

.Stuck SSH to a Cisco switch
[source,bash]

.wpa_supplicant won't start — socket in use
[source,bash]

.Port 443 conflict — can't start a service
[source,bash]

.Investigate what wpa_supplicant is doing during EAP
[source,bash]

===== FD Column Reference

[cols="1,2"]
|===
| FD | Meaning

| `cwd` | Current working directory
| `rtd` | Root directory
| `txt` | Program text (binary)
| `mem` | Memory-mapped file
| `0r` | stdin (read)
| `1w` | stdout (write)
| `2w` | stderr (write)
| `3u` | File descriptor 3 (read/write)
| `4r` | File descriptor 4 (read only)
|===

`r` = read, `w` = write, `u` = read/write. The number is the file descriptor.

==== Command Forensics — Who Ran What, When

Techniques for auditing command execution on a Linux system — useful for security investigations, incident response, and feeding into Wazuh later.

===== Your Shell History (Immediate)

[source,bash]

===== Process Accounting (`pacct` / `psacct`)

Kernel-level — logs every process execution regardless of shell history manipulation.

[source,bash]

===== Audit Framework (`auditd`)

The real forensic tool — kernel-level syscall auditing.

[source,bash]

===== Journal (`systemd-journald`)

[source,bash]

===== File Access Forensics (`stat` + `find`)

[source,bash]

===== Live Process Monitoring

[source,bash]

===== Quick One-Liner: "What Did I Just Do?"

[source,bash]

===== Wazuh Integration (Future)

These data sources map directly to Wazuh agent configuration:

[cols="1,1,1"]
|===
| Source | Wazuh Module | Config

| auditd
| `<localfile>` → `/var/log/audit/audit.log`
| Rule group `audit_command`

| journald
| `<journald>` module
| Filter by `_COMM`

| shell history
| `<localfile>` → `~/.zsh_history`
| Custom decoder needed

| file integrity
| `<syscheck>`
| Directories: `/etc/wpa_supplicant`, `/etc/ssl`
|===

When Wazuh indexer is deployed (blocked by k3s NAT — 92 days), these become searchable and alertable.

==== `stat()` Syscall — Forensics Foundation

Discovered through an `mv` error: `cannot stat` is not a generic error — it's the kernel telling you exactly which syscall failed and why.

===== The Error That Teaches

[source,bash]

`mv` calls the `stat()` syscall BEFORE moving anything. It needs the file's metadata (inode, size, permissions, timestamps) to know what it's operating on. When `stat()` returns `ENOENT` (error: no entry), the kernel says "this path doesn't exist in the directory's inode table."

Every file operation starts with `stat()`:

[source,bash]

.Output breakdown

===== Forensic Significance of Each Timestamp

[cols="1,2,2"]
|===
| Timestamp | What triggers it | Forensic value

| `atime` (Access)
| Reading the file (`cat`, `grep`, `bat`)
| Shows when the file was last opened — can prove access

| `mtime` (Modify)
| Writing content (`sed -i`, `echo >>`, editor save)
| Shows when content last changed — **can be faked** with `touch -t`

| `ctime` (Change)
| Any metadata change (rename, `chmod`, `chown`, content write)
| Shows when anything about the file changed — **cannot be faked** without raw disk access

| `Birth`
| Inode creation (`touch`, `cp`, first write)
| When the file was born — only available on modern filesystems (btrfs, ext4 with 256-byte inodes)
|===

.Key forensic insight
`mtime` can be spoofed: `touch -t 202501011200 file` sets any time you want. `ctime` **cannot** — it's updated by the kernel on every metadata operation. If `ctime` is newer than `mtime`, someone tampered with `mtime`.

===== The Inode — File Identity

The inode number is the file's true identity. Filenames are just directory entries pointing to inodes.

[source,bash]

A renamed file keeps its inode. A copied file gets a new one. This is how forensic tools track files across renames.

[source,bash]

===== `strace` — Watch the Syscalls Live

You can watch `stat()` being called in real time:

[source,bash]

`strace` intercepts every syscall between a program and the kernel. This is how you see what `mv`, `cp`, `rm`, `ls` actually DO — they're all just wrappers around `stat()`, `rename()`, `unlink()`, `readdir()`.

===== The C Connection

`stat()` maps directly to a C struct — this is what you'll implement in the syscall phase of your C curriculum:

[source,c]

Every tool you use daily — `ls`, `find`, `mv`, `cp`, `rm` — calls this struct. When `mv` says `cannot stat`, it's this exact code path failing with `errno = ENOENT`.

===== Commands to Practice

[source,bash]

==== DNS Inventory — `dig` Loop Automation

Built a single `for` loop that queries DNS for every infrastructure host. First real automation — replaces 19 manual `dig` commands with one pipeline.

===== The Loop

[source,bash]

.How it works
* `kvm-0{1,2}` — brace expansion generates `kvm-01 kvm-02` (NOT glob `[1,2]` which matches filenames)
* `dig +short` — returns just the IP, no headers
* `@10.50.1.90` — queries BIND primary directly (not system resolver)
* `printf "%-25s"` — left-aligned, 25-character-wide column for clean table output

===== Infrastructure Inventory (2026-06-21)

Queried against BIND primary (`@10.50.1.90`):

[cols="2,1,1"]
|===
| Host | IP | Status

| kvm-01 | 10.50.1.110 | Resolves
| kvm-02 | 10.50.1.111 | Resolves
| nas-01 | 10.50.1.70 | Resolves
| nas-02 | 10.50.1.71 | Resolves
| vyos-01 | 10.50.1.2 | Resolves
| vyos-02 | 10.50.1.3 | Resolves
| bind-01 | 10.50.1.90 | Resolves (primary)
| bind-02 | 10.50.1.91 | Resolves (secondary)
| ipa-01 | 10.50.1.100 | Resolves
| ipa-02 | 10.50.1.101 | Resolves
| keycloak-01 | 10.50.1.80 | Resolves
| keycloak-02 | 10.50.1.81 | Resolves
| ipsk-mgr-01 | 10.50.1.30 | Resolves
| ipsk-mgr-02 | 10.50.1.31 | Resolves
| vault-01 | 10.50.1.60 | Resolves
| vault-02 | 10.50.1.61 | Resolves
| vault-03 | 10.50.1.62 | Resolves
| certmgr-01 | 10.50.1.63 | Resolves
| home-dc01 | 10.50.1.50 | Resolves
| home-dc02 | 10.50.1.51 | Resolves
| 9800-wlc-01 | 10.50.1.40 | Resolves (alias: wlc-01)
| 9800-wlc-02 | 10.50.1.41 | Resolves (alias: wlc-02)
| k3s-master-01 | 10.50.1.120 | Resolves
| k3s-master-02 | 10.50.1.121 | Resolves
| k3s-master-03 | 10.50.1.122 | Resolves
| ise-01 | 10.50.1.20 | Resolves
| ise-02 | 10.50.1.21 | Resolves (VM shut off on kvm-02 — pending delete)
| gitea-01 | 10.50.1.70 | Resolves (same IP as nas-01)
| 3560cx-01 | 10.50.1.10 | Resolves (switch)
| 9300-01 | 10.50.1.11 | Resolves (switch)
| ipmi-01 | 10.50.1.200 | Resolves (BMC)
| ipmi-02 | 10.50.1.201 | Resolves (BMC)
| vyos-vip | 10.50.1.1 | Resolves (VRRP VIP)
| wazuh | 10.50.1.132 | Resolves
| wazuh-indexer | 10.50.1.130 | Resolves
| wazuh-dashboard | 10.50.1.133 | Resolves
| wazuh-workers | 10.50.1.134 | Resolves
| wazuh-api | 10.50.1.134 | Resolves (same IP as workers)
| prometheus | 10.50.1.131 | Resolves
| alertmanager | 10.50.1.131 | Resolves (same IP as prometheus)
| grafana | 10.50.1.131 | Resolves (same IP as prometheus)
| modestus-aw | 10.50.40.102 | Resolves (VLAN 40)
| modestus-razer | 10.50.10.130 | Resolves (VLAN 10)
| modestus-p16g | — | No A record (DHCP — currently 10.50.1.204)
| thinkpad-x1 | — | No A record (retired?)
| modestus-p50 | — | No A record (retired?)
| gabriel-workstation | — | No A record
|===

===== Observations

* **45 A records in zone** — confirmed via AXFR from bind-02
* **Shared IPs detected:** prometheus/alertmanager/grafana share 10.50.1.131; wazuh-workers/wazuh-api share 10.50.1.134; nas-01/gitea-01 share 10.50.1.70; 9800-wlc-01/wlc-01 share 10.50.1.40
* **modestus-p16g has no A record** — DHCP assigned (currently 10.50.1.204). Consider static A record or DHCP reservation.
* **modestus-aw is on VLAN 40** (10.50.40.x), **modestus-razer is on VLAN 10** (10.50.10.x) — different segments from infrastructure (10.50.1.x)
* **thinkpad-x1, modestus-p50, gabriel-workstation** — no DNS records. Retired or not yet registered.
* **ise-02** — DNS record exists but VM is shut off on kvm-02. Pending delete.

===== Verify against secondary DNS (`@10.50.1.91`)

[source,bash]

Both servers should return identical results. If they differ, zone transfer is stale.

===== Drift Detector

Silent when healthy, loud when broken — runbook check, not a script.

.Alert only on primary ≠ secondary
[source,bash]

No output = healthy. Any output = investigate immediately.

===== Generate `80-d000-hosts.conf` from DNS

This loop produces SSH config entries from the DNS inventory — the missing piece for the modular SSH config.
Run without redirect to preview, then append `> path` to write.

[source,bash]

===== KVM VM Inventory (2026-06-21)

After confirming SSH resolved all hosts, pulled VM state from both hypervisors.

.Remote inventory loop (run from workstation — no manual SSH needed)
[source,bash]

.kvm-01 (10.50.1.110) — 10 VMs running
[listing]
....
 Id   Name            State
-------------------------------
 1    ipsk-mgr-01     running
 2    vyos-01         running
 3    bind-01         running
 4    vault-01        running
 5    home-dc01       running
 6    ipa-01          running
 7    9800-WLC-01     running
 8    k3s-master-01   running
 14   ise-01          running
 22   certmgr-01      running
....

.kvm-02 (10.50.1.111) — 5 VMs running, 1 stale
[listing]
....
 Id   Name          State
------------------------------
 8    bind-02       running
 9    vault-02      running
 10   vault-03      running
 12   vyos-02       running
 13   9800-WLC-02   running
 -    ise-02        shut off
....

WARNING: `ise-02` on kvm-02 is shut off and needs to be deleted — replaced by `ise-01` on kvm-01 during ISE rotation (2026-06-07).

.Delete stale ise-02
[source,bash]

===== Advanced: `paste` + Process Substitution + `awk`

Attempted a more advanced version using `paste` to merge two `dig` outputs side-by-side with `awk` formatting:

.Mistake made
[source,bash]

The shell interprets `VAR=value command` as "set `VAR` as an environment variable for `command` only — but it does NOT set `VAR` as a shell variable." The `<(dig +short "$fqdn")` process substitutions are expanded by the *shell* before `paste` runs. Since `$fqdn` is not a shell variable (only an env var scoped to `paste`), the shell expands `$fqdn` using whatever value it had from the *previous* iteration — or empty on the first pass.

.Fix — separate assignment from command
[source,bash]

.The distinction
[cols="1,2"]
|===
| Syntax | Meaning

| `VAR=value command`
| Set `VAR` as environment for `command` only — shell variable `$VAR` is NOT set for subshells like `$(dig ...)`

| `VAR=value; command`
| Set `VAR` as shell variable, THEN run `command` — `$VAR` is available to everything including subshells
|===

This is a subtle but critical shell parsing rule. The `VAR=value command` form is useful for things like `LANG=C sort file` — but when the command spawns subshells (process substitution, command substitution), those subshells don't see the variable the way you expect.

===== Concepts Learned

* **Brace expansion** — `{1,2}` generates strings, `[1,2]` matches filenames. Different mechanisms.
* **Command substitution in loops** — `$(dig +short ...)` embeds output as a variable inside `printf`
* **`printf` formatting** — `%-25s` left-aligns to 25 chars. Cleaner than `echo` for tabular output.
* **`+short` flag** — `dig` returns just the answer, no headers. Pipeline-friendly.
* **`@server`** — query a specific DNS server instead of the system resolver. Essential for verifying zone data.
* **Guard with `[ -n "$ip" ]`** — only print entries that resolved. Prevents empty `HostName` lines.

==== CLI Exploration — `sed`, `awk`, `find` + Command Substitution

Practical session navigating config files and project directories. Mistakes documented — each one teaches the right pattern.

===== `sed -n` vs `awk` for Line Ranges

Both extract lines by number. `sed` is simpler syntax, `awk` is more powerful when you need logic.

[source,bash]

.Mistake made
[source,bash]

The `<=` operator needs a value on EACH side: `NR` (left) `<=` `66` (right). Writing `NR66<=` puts the number inside the variable name.

.When to use which
[cols="1,2"]
|===
| Tool | Use when

| `sed -n 'X,Yp'`
| Quick line extraction — fewer characters, no logic needed

| `awk 'NR>=X && NR<=Y'`
| Need to combine with field extraction, pattern matching, or formatting in the same command
|===

===== `find` + Command Substitution — Opening Results

The goal: find a directory by partial name, then operate on its contents.

[source,bash]

.Mistake made
[source,bash]

`bat` (and `cat`) read FILES, not directories. When `find` returns a directory, you need to either:

[source,bash]

===== `find` Glob Narrowing — Getting Precise Results

Progressively narrowing the search:

[source,bash]

.Mistake made
[source,bash]

The `-name` pattern must match the FULL filename. `CR-2026-19` skips the month (`06`), so it matches nothing. The file naming standard (STD-003) uses `YYYY-MM-DD` — always include all three date components.

===== Pattern: `find` → `tree` → `bat` Pipeline

The reliable three-step discovery pattern:

[source,bash]

This beats `cd` + `ls` + `cat` because it works from ANY directory — no navigation needed.

===== Real Code: `sed -i` for Config Surgery

The lid-wake fix is a `sed -i` operation. Here's how the same patterns apply to real code changes.

.Replace a specific string in a config file (verify-before/change/verify-after)
[source,bash]

The `s|old|new|` uses `|` as the delimiter instead of `/` — because the old/new strings contain `/` and `"` which would need escaping otherwise. Pick a delimiter that doesn't appear in your strings.

.Change a value in antora.yml
[source,bash]

.Comment out a block (add `#` to lines 57-66)
[source,bash]

.Uncomment the same block (remove leading `# `)
[source,bash]

===== Real Code: `awk` for Extracting Structured Data

`awk` shines when you need to extract, filter, AND format in one pass.

.Extract all monitor names from hyprctl output
[source,bash]

.Extract attribute names and values from antora.yml
[source,bash]

.Count files per directory in a project (field extraction + associative array)
[source,bash]

.Extract all `include::` paths from a file (pattern match + field extraction)
[source,bash]

===== Real Code: `find -exec` for Batch Operations

`find` becomes powerful when you execute commands on the results.

.Verify every CR has a summary.adoc
[source,bash]

.Batch check for hardcoded IPs across all partials
[source,bash]

.Count lines per partial in today's daily notes
[source,bash]

.Open all partials for a CR in nvim (command substitution + find)
[source,bash]

This opens all 5 partials (summary, evidence, implementation, verification, rollback) in nvim's buffer list. Navigate with `:bn` and `:bp`.

// Concern: Graphviz diagram authoring — fundamentals and advanced features
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/graphviz-fundamentals.adoc

==== Graphviz — From First Render to Port-Targeted Wiring

Graphviz beats Visio on three axes: **structured node internals** (HTML labels with per-cell ports), **algorithmic layout** (you describe relationships, `dot` computes placement), and **version control** (plain text diffs, not binary blobs).

===== Workflow — Heredoc to SVG

Every diagram follows the same pattern: write source to `/tmp/`, render, inspect.

.Minimal — plain nodes and edges
[source,bash]

Open the SVG in a browser (`xdg-open /tmp/minimal-topology.svg`) or the PNG in any viewer.
This gets you running in 30 seconds — everything below builds on this skeleton.

===== Feature 1 — HTML Labels (Structured Node Internals)

Plain `label="line\nline"` caps out fast.
HTML labels (`label=<...>`) give you `<TABLE>` with rows, columns, colors, and — critically — `PORT` attributes that edges can target.

.HTML label with ports
[source,bash]

The edge connects *from the RADIUS row* to *the 802.1X column* — not just "ISE to switch."
This is the precision Visio cannot match without manually dragging connection points.

===== Feature 2 — Subgraph Clusters

`subgraph cluster_<name>` draws a box around grouped nodes.
The `cluster_` prefix is mandatory — without it, no visible boundary.

.Clustered infrastructure layers
[source,bash]

===== Feature 3 — Layout Control

Four tools for controlling placement without fighting the algorithm:

.`rank=same` — force horizontal alignment
[source,dot]

.`splines=ortho` — right-angle edge routing (Manhattan geometry)
[source,dot]

.Invisible edges — structural constraints without visual artifacts
[source,dot]

.`newrank=true` — enables rank constraints within subgraphs
[source,dot]

===== Feature 4 — Edge Semantics

Different edge styles encode different relationship types:

[source,dot]

===== Progression — Port Mapping (v1 through v8)

The goal: Cisco-style interface labels sitting on the cable at each end, not inside the node boxes.
This required six iterations to solve — each one taught a different Graphviz constraint.

====== Approach 1 — Port Cells in Switch Table

Ports as visible `<TD>` cells in the switch node, edges target `switch:g1` etc.
Works for showing which port, but the labels are *inside* the box — not on the cable.

.Port cells with targeted edges
[source,bash]

====== Approach 2 — headlabel/taillabel with ortho

`headlabel` places text at the arrow end, `taillabel` at the source.
This is the correct Graphviz mechanism — but **`splines=ortho` sabotages label placement**.
Labels drift to unpredictable positions because the orthogonal routing engine cannot compute label anchors on right-angle bends.

Key learning: `splines=ortho` and `label`/`headlabel`/`taillabel` are fundamentally incompatible.
Use `xlabel` with ortho, or switch to `splines=true` for head/tail labels.

====== Approach 3 — Intermediate Nodes as Port Labels

A different strategy: make the port labels into actual tiny nodes positioned on the cable by the layout engine.
Edges chain through them: `device → eth0-badge → Gi0/1-badge → switch`.

.Intermediate node approach
[source,bash]

Reliable positioning with ortho — the layout engine controls badge placement.
Works well when you need right-angle routing and precise label placement simultaneously.

====== Approach 4 — The Solution: splines=true + invisible port cells

The breakthrough: **drop `splines=ortho`**.
Curved splines support `headlabel`/`taillabel`/`label` placement accurately.
Invisible port cells (`POINT-SIZE="1"` spacer row) in the switch spread cables horizontally.

.Cable labels with curved splines and port-cell spread
[source,bash]

Three label types working together:

- `taillabel` — interface name at the device end (e.g., `eth1`)
- `headlabel` — switch port at the switch end (e.g., `Gi0/1`)
- `label` — protocol/subnet on the cable middle (e.g., `Trunk · VLAN 100`)

`labeldistance=2.0` and `labelangle=25` control positioning.
HTML `<FONT>` in labels — bare colored text, no boxes.

====== Capstone — Full Enterprise Topology (v8)

All techniques combined: HA pairs (VyOS VRRP, WLC SSO), KVM host relationships, 10-port switch, color-coded cable semantics.

.Full infrastructure wiring diagram
[source,bash]

Techniques combined in v8:

- `splines=true` — accurate label placement
- `switch:g1` through `switch:g9` — port-targeted cable spread
- `constraint=false` on HA/VRRP/SSO edges — prevents vertical distortion
- `rank=same` without `subgraph cluster_` — avoids the "already in a rankset" warning
- `style=dashed` for standby paths (vyos-02, wlc-02)
- `style=dotted` with `arrowhead=none` for KVM "hosts" relationships

===== Rendering Options

[source,bash]

`dot` is the right engine for network topologies (directed, hierarchical).
`neato` is useful for peer relationships where hierarchy is misleading.

===== Reference — Catppuccin Mocha Palette for Graphviz

[cols="2,1,2"]
|===
| Color | Hex | Use

| Base (background) | `#1e1e2e` | `bgcolor`
| Surface0 | `#313244` | Default node fill
| Surface1 | `#45475a` | Header rows
| Surface2 | `#585b70` | Borders, muted elements
| Text | `#cdd6f4` | Primary font color
| Subtext0 | `#a6adc8` | Edge labels, secondary text
| Red | `#f38ba8` | Identity / security
| Green | `#a6e3a1` | Endpoints / auth success
| Blue | `#89b4fa` | Network / WAN
| Peach | `#fab387` | PKI / secrets
| Mauve | `#cba6f7` | Directory / compute
| Teal | `#89dceb` | DNS
| Sapphire | `#74c7ec` | Wireless
| Yellow | `#f9e2af` | Warnings / VIPs
| Flamingo | `#f2cdcd` | Annotations
|===

// Concern: D2 diagram authoring — fundamentals and advanced features
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/d2-fundamentals.adoc

==== D2 — From First Render to Interactive SVGs

D2 beats Visio on **styling inheritance** (classes), **rich content** (markdown labels), **interactivity** (tooltips and links in SVG), and **diffability** (YAML-like syntax that reads like documentation).

===== Workflow — Heredoc to SVG

Same discipline as Graphviz: write to `/tmp/`, render, inspect.

.Minimal — containers and connections
[source,bash]

Open with `xdg-open /tmp/minimal-d2.svg`.
Thirty seconds to a rendered topology — everything below adds precision.

===== Feature 1 — Classes (DRY Styling)

The single biggest time-saver D2 has over both Visio and Graphviz.
Define a style once, apply it by name.
Change the color in one place, every node of that class updates.

.Classes defined and applied
[source,bash]

Note: `class: firewall` on `vyos-02` sets the base style, then `style.opacity: 0.6` overrides a single property — inheritance with targeted exceptions.

===== Feature 2 — Markdown Labels

Markdown labels render tables, bold, code, and lists inside nodes.
This is the feature that produces Visio-impossible detail density.

IMPORTANT: When the markdown content contains pipe characters (`|`) — which every markdown table does — use triple-pipe delimiters: `|||md ... |||`.
Single-pipe `|md ... |` causes D2 to misinterpret table `|` as the block terminator.

.Markdown label with embedded table
[source,bash]

===== Feature 3 — Tooltips and Links (Interactive SVG)

These two attributes make SVGs behave like lightweight dashboards.
`tooltip:` shows text on hover.
`link:` makes the node clickable.

.Interactive nodes
[source,bash]

Open the SVG in a browser — hover over ISE to see the tooltip, click to open the admin panel.
Two layers of information density: visual at a glance, operational on interaction.

===== Feature 4 — Containers and Nesting

D2 containers are the equivalent of Graphviz `subgraph cluster_` but with cleaner syntax and unlimited depth.
Connections between nested nodes use dot-path addressing.

.Nested containers
[source,bash]

===== Feature 5 — Grid Layout

`grid-columns` arranges children in a horizontal grid instead of the layout engine's default stacking.
Ideal for VLANs, SSIDs, endpoints — anything that should read as a row of peers.

.Grid layout for VLAN segmentation
[source,bash]

===== Feature 6 — Sketch Mode

`--sketch` renders with a hand-drawn aesthetic — useful for whiteboard-style presentations where pixel-perfect precision signals the wrong message.

[source,bash]

Same source, completely different visual register. No redraw required.

===== Rendering Options

[source,bash]

`--watch` is the killer workflow feature: edit in one terminal, the SVG updates live in the browser.

===== When Graphviz Wins Instead

D2 does not have port-based connections.
If you need an edge from "the RADIUS row of ISE" to "the 802.1X column of the switch," Graphviz's HTML labels with `PORT` are the only option.

D2's markdown labels are richer for content but cannot target sub-elements for edge attachment.

[cols="2,1,1"]
|===
| Capability | D2 | Graphviz

| DRY styling (classes) | ✅ Winner | ❌ Inline only
| Rich node content | ✅ Markdown | ✅ HTML tables
| Port-targeted edges | FAILne | ✅ Winner
| Interactive SVG | ✅ Tooltips + links | FAILne
| Layout control | Good (`grid-columns`) | ✅ `rank`, `splines`, invisible edges
| Dark theme | `--dark-theme 200` | Manual colors
| Hand-drawn mode | `--sketch` | FAILne
| Watch/live reload | `--watch` | FAILne
| Edge routing | Decent | ✅ `splines=ortho`
|===

Use D2 for **architecture and context** (rich nodes, interactive hover, presentation-ready).
Use Graphviz for **wiring precision** (which port connects to which port, orthogonal routing).

// Concern: Diagram workflow — verification, audit, and direct rendering from CLI
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/diagram-workflow-verification.adoc

==== Diagram Workflow — Verification & CLI Rendering

===== Direct Rendering (Skip the Heredoc)

The heredoc pattern (`tee /tmp/... << 'EOF'`) exists for the documentation reader who copies from the rendered Antora page.
As the author, render example files directly:

.Render a single example by name
[source,bash]

.Render and open in one shot
[source,bash]

===== Cross-Reference: Partial → Example File

Verify that an `include::example$` directive in a partial points at a real file on disk.

.Check a single include
[source,bash]

Output shows the include line from the partial, then the first 10 lines of the target file — visual confirmation that the path resolves and the content is correct.

===== Audit All Includes in a Partial

Extract every `include::example$` path, strip the AsciiDoc syntax, and verify each file exists on disk.

.Audit all example includes in a partial
[source,bash]

Any line showing `MISSING` means a broken include — the partial references a file that does not exist.

.Audit ALL partials in a directory at once
[source,bash]

===== Batch Render All Examples

Test that every `.dot` and `.d2` file in the lab directory renders without error.

.Render all Graphviz examples
[source,bash]

.Render all D2 examples
[source,bash]

===== Jump to Line in Any File by Name

.Open a file at a specific line — find + command substitution + editor
[source,bash]

.grep for the line number first, then jump
[source,bash]

.One-liner — grep finds the line, awk extracts the number, nvim opens it
[source,bash]

Works with any editor: `nvim`, `vim`, `code -g file:line`, `hx file:line`.

===== Pattern Anatomy

[cols="1,2"]
|===
| Pattern | What It Does

| `$(find -name '*.dot')`
| Command substitution — embeds `find` output as an argument to `dot`

| `sed -n '/pattern/p'`
| Print only lines matching pattern — targeted extraction without `grep`

| `awk -F'[$\\[\\]]' '{print $2}'`
| Split on `$`, `[`, `]` simultaneously — strips AsciiDoc `include::example$...[`

| `while read f; do ... done`
| Loop over piped input line-by-line — each line becomes `$f`

| `${match:-MISSING}`
| Parameter expansion — if `$match` is empty, substitute `MISSING`

| `"${f%.dot}"`
| Suffix removal — `07-full-topology.dot` becomes `07-full-topology`

| `printf "%-55s %s\n"`
| Left-aligned column — `%-55s` pads the first field to 55 characters
|===

// Concern: xargs pipeline patterns learned and used today
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/xargs-pipeline-patterns.adoc

==== xargs Pipeline Patterns — Commands Used Today

===== find | xargs tree — Multi-Match Directory Visualization

.Show the daily notes directory structure
[source,bash]

When `find` returns one match, equivalent to `tree path`. When `find` returns multiple matches, `tree` renders all of them — the pipeline form scales where the direct path doesn't.

.Same idea: find all graphviz example directories
[source,bash]

===== find | xargs wc — Bulk Line Counts

.Count lines in all today's partials
[source,bash]

.Count lines in all diagram examples
[source,bash]

===== find | xargs grep — Search Across Matched Files

.Find all includes referencing a specific example
[source,bash]

`-l` returns filenames only — which partials reference the full topology diagram.

.Find all files using a specific IP
[source,bash]

===== find | xargs dot — Batch Render Diagrams

.Render every .dot file to SVG
[source,bash]

`-I{}` sets the placeholder. `sh -c` wraps the command so `basename` and parameter expansion work inside xargs.

.Same with d2
[source,bash]

===== find | xargs diff — Compare Files

.Diff two versions of a diagram found by name
[source,bash]

Process substitution here, not xargs — but the instinct to compose `find` output as arguments applies in both.

===== Parallel Execution

.Render all diagrams in parallel (4 workers)
[source,bash]

* `-print0` — null-delimited output (safe for filenames with spaces)
* `-0` — xargs reads null-delimited input
* `-P4` — 4 parallel workers

===== Pattern Reference

[cols="1,2"]
|===
| Pattern | What It Does

| `find ... \| xargs cmd`
| Feed find results as arguments to `cmd`

| `xargs -I{}`
| Replace `{}` with each input line — one invocation per line

| `xargs -n2`
| Batch 2 arguments per invocation

| `xargs -P4`
| Run 4 invocations in parallel

| `xargs -0` + `find -print0`
| Null-delimited — safe for filenames with spaces/special chars

| `xargs sh -c '...' _ {}`
| Shell wrapper — enables parameter expansion inside xargs

| `xargs -p`
| Prompt before each execution — dry-run mode

| `xargs -t`
| Print each command before executing — trace mode
|===

===== When NOT to Use xargs

[source,bash]

`xargs` wins when: many files, parallel execution needed, or the command doesn't accept piped stdin. `$(find)` wins when: single file, inline argument. `for` wins when: per-item conditionals or formatted output.

// Concern: gopass pipeline patterns — ls, grep, xargs, awk for secret store operations
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/gopass-pipeline-patterns.adoc

==== gopass Pipeline Patterns

All commands inspect *paths and keys only* — never expose secret values in terminal output or pipes.

===== Search and Filter

.Flat list + grep — find entries by pattern
[source,bash]

.Multiple patterns — find all network device credentials
[source,bash]

.Count entries per directory — inventory the store
[source,bash]

Splits on `/`, keeps the first 3 path segments, counts entries per subtree. Shows where credentials concentrate.

.Find entries with a specific YAML key
[source,bash]

Slow (one gopass call per entry) but finds every entry containing a `username:` field.

===== Copy to Clipboard — Targeted Access

.Copy password for a matched entry
[source,bash]

Command substitution resolves the path, `-c` copies the password. Works when `grep` returns exactly one match.

.Interactive selection with fzf
[source,bash]

Fuzzy search the entire store. Select with arrow keys, password copies on enter.

.Copy a specific field
[source,bash]

===== Bulk Operations with xargs

.List all entries under a path — keys only, no values
[source,bash]

Extracts just the entry names from a subtree.

.Audit: find entries missing a specific field
[source,bash]

.Export paths (not values) for documentation
[source,bash]

Generates an AsciiDoc table of entry names and their gopass paths — safe for documentation because no values are exposed.

===== Environment Variables — Never Touch Disk

.Load credentials into env for a script
[source,bash]

Password lives in process memory only — never written to a file, never in shell history (if the export is in a script, not typed raw).

.Use in a curl call — inline substitution
[source,bash]

===== yq Integration — Query Structured Entries

gopass entries use YAML after the password line. Pipe to `yq` for structured access.

.List all keys in an entry (never exposes values)
[source,bash]

The password is the first line (before `---`). `sed '1,/^---$/d'` strips the password and separator, leaving clean YAML for `yq`. Without this, `yq` errors on the non-YAML password line.

.Extract a specific field
[source,bash]

.Extract nested credentials to clipboard (Wayland)
[source,bash]

.Build a summary table from structured entries
[source,bash]

.Compare YAML structure between two entries
[source,bash]

Shows which fields exist in one entry but not the other — structural audit without exposing values.

.Extract ports as a flat list
[source,bash]

===== wl-copy — Wayland Clipboard

.Copy a yq-extracted field to clipboard
[source,bash]

.Copy password directly (first line only)
[source,bash]

.Paste from clipboard into a variable (never touches disk)
[source,bash]

===== Diff and Audit

.Compare two entries — keys only, not values
[source,bash]

Process substitution feeds both entries into `diff`. The `grep -v` strips the password line (first line, typically base64-like). Shows which YAML keys differ between entries.

.Find stale entries — older than N days (git-backed)
[source,bash]

===== Pattern Reference

[cols="1,2"]
|===
| Pattern | What It Does

| `gopass ls --flat`
| All entries as flat paths — pipe-friendly, no tree formatting

| `gopass ls --flat \| grep -i`
| Case-insensitive search across all entry paths

| `gopass show -o`
| Password only (first line) — for `$(...)` substitution

| `gopass show entry '.key'`
| Dot-path YAML access — single quotes mandatory

| `gopass -c`
| Copy password to clipboard (45s auto-clear)

| `gopass show -c entry '.key'`
| Copy a specific YAML field to clipboard

| `gopass ls --flat \| fzf`
| Interactive fuzzy search — pipe result to `gopass -c`

| `gopass ls --flat \| awk -F/`
| Split paths into segments for counting, grouping, or table generation
|===

===== Network Connectivity Test Commands

Reference commands for validating network connectivity, DNS resolution, TLS certificates, and HTTP reachability. Useful for verifying guest SSID end-to-end and general troubleshooting.

==== DNS Resolution

.Forward lookup
[source,bash]

.Reverse lookup
[source,bash]

.Trace resolution path
[source,bash]

.Query specific record types
[source,bash]

==== TLS Certificate Inspection

.Full cert subject, issuer, and validity
[source,bash]

.Full chain with SANs
[source,bash]

.Verify ISE portal cert (Let's Encrypt)
[source,bash]

.Check cert expiry only (days remaining)
[source,bash]

.Verify cert against specific CA
[source,bash]

==== HTTP Reachability

.Status code only (silent)
[source,bash]

.Follow redirects + show final URL
[source,bash]

.Response headers
[source,bash]

.Time breakdown (DNS, connect, TLS, total)
[source,bash]

==== TCP Connectivity

.Port reachability (no HTTP)
[source,bash]

.Multiple ports in one pass
[source,bash]

==== ICMP + Routing

.Basic reachability with latency
[source,bash]

.Trace path to internet from guest VLAN
[source,bash]

.MTU discovery (catch PMTU issues)
[source,bash]

==== RADIUS

.Test RADIUS auth from WLC perspective (from ISE debug)
[source,bash]

==== Guest SSID End-to-End Validation Sequence

.Run from a device on the guest network (10.50.30.x)
[source,bash]

=== Ad-Hoc Requests

// Concern: Alex's Windows machine — no internet, DHCP triage from VyOS
// Partial: partials/worklog/daily-notes/2026-06/2026-06-21/alex-internet-triage.adoc

==== Alex — Internet Connectivity Issue (In Progress)

Alex's Windows computer has no internet. Triage started from VyOS firewall console.

===== Findings So Far

.DHCP leases — Alex has NO active lease
[source,console]

Only one lease active (the AP). Zero leases on the IOT pool.

.DHCP pool statistics — IOT pool exists, 0 leases
[source,console]

.IOT DHCP pool config — pool is correctly configured
[source,console]

.ARP table — devices on VLAN 40 that DO have connectivity

NOTE: `10.50.40.144` has hundreds of active NAT translations — so VLAN 40 internet access works. The problem is specific to Alex's machine, not the VLAN.

===== Next Steps — Resume Here

.Step 1: Get Alex's current IP config from PowerShell
[source,powershell]

If `169.254.x.x` (APIPA) → machine is not receiving DHCP. Problem is between the machine and VyOS.

If valid `10.50.40.x` IP → machine has DHCP but can't reach the internet. Check gateway and DNS.

.Step 2: Test layer by layer from Alex's PowerShell
[source,powershell]

.Step 3: If no DHCP — force a renewal
[source,powershell]

.Step 4: Check which SSID she's connected to
[source,powershell]

If she's on Domus-Secure (802.1X) instead of Domus-IoT (iPSK), she needs an ISE-issued certificate to authenticate — which she won't have. Should be on HomeRF or Domus-IoT.

===== VyOS Commands Used

[source,bash]

// Session: Ad-Hoc Requests — 2026-06-21
// Included by: daily-notes/2026-06/2026-06-21.adoc

==== Ad-Hoc Requests

_Capture walk-ups, Teams pings, and unplanned work here._

*

---

// Worklog Section: Work (CHLA) — Assembler
// Usage: include::partial$worklog/work-chla.adoc[]
// Contains: All work domains via sub-partials
//
// PARADIGM: Each concern = its own file in work/
// FILES: timekeeping.adoc, projects.adoc, priorities.adoc, tickets.adoc
//
// MAINTENANCE: Comment out sections for weekend/non-work worklogs
// Weekend: comment out timekeeping + tickets, keep projects + priorities

== Work (CHLA)

// Worklog Work: Timekeeping
// Usage: Included by worklog/work-chla.adoc assembler
// Contains: PeopleSoft time entry reminder

CAUTION: **CHARGE TIME IN PEOPLESOFT - CRITICAL.** Do this NOW before anything else.

xref:projects/chla/PRJ-peoplesoft-time-entry.adoc[PeopleSoft Time Entry Reference]

// Worklog Work: Projects
// Usage: Included by worklog/work-chla.adoc assembler
// Contains: P0/P1/P2 project priorities + case study links

// Critical Projects (P0) — Blocking or critical priority
// Usage: include::partial$trackers/work/projects/p0.adoc[]
// Last updated: 2026-05-12

=== Critical (P0)

[cols="2,3,1,1,1,2"]
|===
| Project | Description | Owner | Status | Due | Blocker

| Linux Research (Xianming Ding)
| EAP-TLS for Linux workstations, dACL, UFW
| Evan
| BEHIND (72 days overdue)
| 02-24
| Certificate "password required" - nmcli fix documented

| iPSK Manager
| Pre-shared key automation
| Ben Castillo
| BEHIND
| --
| DB replication issues

| MSCHAPv2 Migration
| Legacy auth deprecation — 6,227 devices, 5 waves. 6 batch SQL queries + 3-API endpoint profile script added (05-11). Report due.
| Evan
| 25% — Report due, batch queries ready
| 05-30
| Report to turn in

| Research Segmentation
| All endpoints to Untrusted VLAN
| Evan
| BLOCKED
| --
| CISO decision pending

| Disaster Recovery
| ISE DR scoping — dot1x closed mode = total blackout
| Evan
| Scoping
| --
| --

| Mandiant Remediation
| Copy 4/16 findings, Guest ACL lab, Q2 assessment
| Evan
| Active
| --
| --

| SIEM QRadar → Sentinel
| Full SIEM platform transition. Monad console error resolved 05-12. Secrets configured. Blocked on DCR creation (Rule ID + Stream Name). Azure private network policy unresolved.
| Evan
| Active — blocked on DCR
| Q2 2026
| Victor/Mauricio: create DCR, resolve Azure network policy

| Abnormal Security
| AI email platform — ESA cutover. CR assigned, CAB May 12 15:00. Implementation May 14 10:00.
| Evan
| Active — CAB today 15:00
| 05-14
| Pre-CAB checklist: confirm Tyler, Jason, Sarah
|===

// High Priority Projects (P1) — Important but not blocking
// Usage: include::partial$trackers/work/projects/p1.adoc[]
// Last updated: 2026-04-22

=== High Priority (P1)

[cols="2,3,1,1,1"]
|===
| Project | Description | Owner | Status | Target

| ISE 3.4 Migration
| Upgrade from 3.2p9
| Evan
| Blocked — maintenance window needed
| Q2 2026

| Switch Upgrades
| IOS-XE fleet update (C9300, 3560CX)
| Evan
| Pending
| Q2 2026

| Spikewell BYOD VPN
| dACL SQL, AD group integration
| Evan
| Active
| --

| Strongline Gateway
| MAC capture, Identity Group setup — 37 days aging
| Evan
| Active — David Rukiza assigned
| --

| Abnormal Security
| AI email security platform research, ESA cutover timeline
| Evan
| Newly assigned
| --

| DMZ Migration
| External services audit behind NetScaler
| Evan
| Audit phase
| --

| Firewall Audit (murus-portae)
| EtherChannel query, prefilter, policy assignments
| Evan
| Scoping — ASA API creds needed
| --

| iPSK Manager HA
| Server 2 config, TLS, SQL security audit
| Evan
| In progress
| --

| Sentinel KQL
| Build proficiency, distinguish from team
| Evan
| Onboarding
| --

| VNC Blocking
| Block and eliminate VNC protocol enterprise-wide
| Evan
| Active — Phase 0 (Discovery)
| Mid-June 2026
|===

// Strategic Projects (P2) — Long-term or not yet started
// Usage: include::partial$trackers/work/projects/p2.adoc[]
// Last updated: 2026-04-22

=== Strategic (P2)

[cols="2,3,1,1"]
|===
| Project | Description | Owner | Status

| HHS Regulatory Compliance
| New HHS security policies implementation
| TBD
| NOT STARTED

| InfoSec Reporting Dashboard
| PowerBI metrics for executives
| TBD
| NOT STARTED

| EDR Migration (AMP → Defender)
| Endpoint protection consolidation
| TBD
| NOT STARTED

| Azure Legacy Migration
| Modern landing zone
| Team
| In Progress

| ChromeOS EAP-TLS
| SCEP + Victor, Paul testing
| Victor
| In Progress
|===

// Case Study Links — TAC, incidents, changes, RCAs
// Usage: include::partial$trackers/work/links/case-studies.adoc[]
// Last updated: 2026-04-04

==== Case Studies (March 2026)

**TAC Cases:**

* xref:case-studies/tac/chla-8021x-auth-failures/index.adoc[TAC-2026-03 - 802.1X Auth Failures]

**Incidents:**

* xref:case-studies/incidents/strongline-gateway-vlan/index.adoc[INC - Strongline Gateway VLAN]
* xref:case-studies/incidents/ise-incident-defense/index.adoc[PREP - ISE Incident Defense]

**Changes:**

* xref:case-studies/changes/vault-backup-selinux/index.adoc[CR - Vault Backup SELinux]

**RCAs:**

* xref:case-studies/rca/8021x-eaptls-ca-chain/index.adoc[RCA - 802.1X EAP-TLS CA Chain]
* xref:case-studies/rca/wifi-dhcp-failure/index.adoc[RCA - WiFi DHCP Failure]

// Worklog Work: Daily Priorities
// Usage: Included by worklog/work-chla.adoc assembler
// Contains: Today's actionable priority checkboxes

=== Today's Priorities

// Current Priorities — Persistent P0/P1 tracker
// Usage: include::partial$trackers/work/priorities/current.adoc[]
// Last updated: 2026-06-09
//
// RULES:
// - No dated sections (morning/meeting checklists go in the WORKLOG, not here)
// - Items stay until YOU confirm completion, then move to === Completed with date
// - Day counts use {origin-*} attributes from antora.yml — update-days recalculates
// - New work items from d001/ get added here during daily triage
// - Review weekly: anything resolved? anything to add?

=== P0 — Critical / Blocking

==== Security & Compliance

* [ ] **ISE 3.2 Patch 10 upgrade** — CVE-2026-20147 CVSS 9.9 / CVE-2026-20148. Propose maintenance window once patch confirmed on software.cisco.com.
* [ ] **ISE Advisory sa-ise-rce-traversal-8bYndVrZ** — check Patch 10 availability
* [ ] **Mandiant Remediation** — findings status tracked. Working session prep + defensive posture documented (comms-2026-04-24). Copy 4/16 updates into Excel at work. Guest ACL lockdown (WIR-M-01) pending lab validation. appendix-todos updated with MSCHAPv2 milestones.
* [ ] **Guest ACL update** — guest redirect ACL work needed. Lab validate GUEST_CWA_REDIRECT_MAX_SECURITY in d000, then joint CR with NE. On today's task list.
* [ ] **Disaster Recovery & Downtime Procedures** — ISE top priority (dot1x closed mode = SPOF for network access)
** ISE DR: Document failover sequence — PAN, MnT, PSN priority order
** ISE DR: RADIUS dead-server detection on WLCs/switches — critical-auth VLAN fallback
** ISE DR: Backup/restore procedures — scheduled config backups, tested restores
** FTD/FMC DR: FMC loss = no policy management
** Network DR: Core/distribution switch failure, STP reconvergence, HSRP failover
** Document RTO/RPO per system

==== SIEM Migration (QRadar → Sentinel)

* [ ] **SIEM QRadar → Sentinel Migration** — LEAD ROLE. 4 collection iterations (Apr 16, 17, 17-streamlined, 20-streamlined). Python chart pipeline built (`qradar-charts.py`). Migration XLSX generated. Verification pending. Comms sent Apr 23.
** d001 artifacts: 8 JSON exports, 2 CSV inventories, migration XLSX, top5 source SVG/PNG, verification doc
** Dependency: Monad pipeline for log source transition
** Dependency: Sentinel KQL proficiency for query migration
* [ ] **Monad Pipeline Evaluation** (origin: {origin-monad}) — lead role. Console error RESOLVED 05-12. **06-09: Architecture decision — rsyslog (CHLXSYSLOG01) as collection tier → Monad → Sentinel.** ISE lab → rsyslog → Monad 6-step execution guide created with 10 API calls. ASA lab logs already flowing through rsyslog. DCR still needed — Victor + Mauricio.
* [ ] **Sentinel KQL** — build proficiency, distinguish from team. Azure portal access acquired.
* [ ] **QRadar log source report** — run AQL queries, fetch JSON, generate Python Excel

==== Active Deployments & Migrations

* [ ] **MSCHAPv2 Migration** — 6-sheet Standard Report ready. **Migration window 05-04 to 05-30 CLOSED.** Confirm final report status and next steps with team. 6,227 MSCHAPv2 devices, 14,249 EAP-TLS/TEAP (70% migrated).
* [x] **MSCHAPv2 weekly cadence** — recurring Wednesday call established (first 04-22). Completed 2026-04-22.
* [x] **MSCHAPv2 ownership matrix** — sent in scoping email 4/24 with manager callouts (@Albert, @John). Completed 2026-04-24.
* [ ] **TCP Clocks deployment** — Batch 1: 7 clocks validated (OUI 40:AC:8D). **Batch 2 (06-09): 9 new MACs (OUI 40:AC:BD) added via ERS.** 1 one-off reassigned. **New switch deployed without RADIUS/AAA — clocks can't authenticate.** Switch onboarding template + 3 validation queries documented. ERS queries self-contained with `ers` function.
* [ ] **SRT Research VLAN — confirm roles with Tony Sun**: Tony implementor, Evan tester. CAB approved 04-21.
* [ ] **Downtime Computers enforcement** — draft ISE AuthZ rule: medigate_724 + Wireless = DenyAccess. Separate CR. d001: DC queries, audit CSVs (v1-v3), wireless violations report delivered 04-21.
* [ ] **Enterprise Linux 802.1X** — standardize Shahab/Ding deployment (CISO priority). Overdue since 02-24. Blocked by nmcli cert fix. **06-15: Assembler build fixed (26 errors → 0). Segmentation document extension to 06-16.** `d001 open linux-research` to work on it.
* [ ] **Abnormal Security** — CR-2026-05-07. Implemented 05-13. **06-09 update:** Full policy review — 20-section EOP validation commands rebuilt, Hoxhunt SCL-1 investigation (intentional bypass confirmed), sclizer junk folder triage (~800 emails), Outlook reactions audit added, Connect-ExchangeOnline msalruntime fix documented. ESA migration expansion in progress — priority to move off ESA to full environment.
** Team: Cox/William, Landeros/Jason, Rosado/Evan, Naranjo/Mauricio, Sandoval/Carlos
* [ ] **ASA VPN: Okta RADIUS → Entra SAML** — (NEW 06-09) 5-phase migration plan built. ASA baseline captured (2 tunnel groups: CHLA_CORPORATE_USERS, CHLA_BYOD_USERS). 6 ISE policy screenshots. Tony Sun (ASA), Justin Halbmann (Entra/Okta), Evan (ISE). **VPN cert expires 07-28.** PDF deliverable ready. Share with team this week.

==== Tube System Upgrade (NEW — 06-01)

* [ ] **Tube System Upgrade** — iTrack 3528165. 15x 10" TS stations need MAC addresses added to ISE identity group IoT_Onboard. MACs received from vendor (C8:1A:FE:20:xx:xx series). Station list spans ICU (CTICU, PICU, BMT, NICU, NICCU), ED, Surgery, Trauma, Pharmacy. Vendor contact: John Genest. Rationale: manufacturer no longer supports current system; failure risks delayed/missed patient care.

==== BMS Controller Segmentation (MIGRATED — 06-09)

* [x] **BMS Controller Segmentation** — Full migration from Principia LaTeX to d001. 12 partials, 5 Mermaid diagrams, 4 legacy PDFs, ISE screenshots. `d001 open bms-controller`. Completed 2026-06-09.

==== BMS Device Inventory (NEW — 04-24)

* [ ] **BMS Device Inventory** — 72 devices discovered across 37 switches (04-24). Profile-driven architecture (Claroty/Medigate). 16 queries built. Phase 0 complete. Next: cross-reference with Visio diagrams, classify by function, begin D2 diagrams. Cleanup: delete 4 orphaned test groups, migrate 4 retire-dACL devices, investigate 3 null-profile devices.

==== VNC Blocking (NEW — 05-11)

* [ ] **VNC Blocking** — block and eliminate VNC enterprise-wide. Due mid-June 2026. Phase 0: discovery. January AQL query baseline to incorporate. Cross-reference BMS inventory for VNC-capable devices.

==== Investigations & Audits

* [ ] **Murus Portae (WAF)** — Phase 0 discovery in progress. FMC cert expired. d001: DMZ NetScaler WAF investigation, zone map, architecture D2 diagrams (v1+v2 SVGs), FMC REST API reference guide, ops script. FMC API returning zero ACP rules — under investigation.
* [ ] **Firewall audit** — FMC discovery inventory done (d001: fmc-discovery-2026-04-16). EtherChannel query, prefilter, policy assignments pending.
* [ ] **IoT Dr. Kim devices** — RECURRING. All 4 MACs validated in IoT_iPSK_VLAN1620_Misc (04-24). v2 validation queries built with 7 deep analysis queries (group flapping, credential leakage, profile drift, NAS tracking, remediation timeline, deny audit, OUI scan). Revalidate — confirm no flapping since 04-24.
* [x] **IoT device validation queries** — v2 created with partials architecture, 16 queries across ERS/MnT/DataConnect/FMC. Completed 2026-04-24.

==== Stale Blockers (carried via carryover tracker)

* [ ] **k3s NAT verification** — rule 170, 10.42.0.0/16 pod network (origin: {origin-k3s-nat}). **92 days.** Blocks Wazuh indexer recovery → blocks SIEM visibility. Decide: test or defer to Q3.
* [ ] **Strongline Gateway VLAN fix** — 8 devices wrong identity group (origin: {origin-strongline}). **85 days.** David Rukiza assigned — follow up on status.

==== Administrative

* [ ] **PeopleSoft** — track time for current week
* [ ] **iTrack tickets** — close open tickets
* [ ] **KQL library** — build initial queries in codex + d001
* [ ] **Linux Research project** — finalize and review
* [ ] **Tax filing 2025 (MFJ)** — see encrypted case file in `data/d000/personal/` for details and action items

=== P1 — Important

* [ ] **MSCHAPv2 action-item tracker** — owner/status/next-steps per workstream
* [ ] **ISE admin MFA enforcement** — recommendation tied to advisory (interim control pending Patch 10)
* [ ] **DMZ Migration** — external services audit behind NetScaler. Linked to Murus Portae investigation.
* [ ] **Vocera/Wyse iTrack RCA** — complete root cause report
* [ ] **GCC ISE Support** — 3/4 nodes restored, PSN-04 deferred
* [ ] **Wazuh indexer recovery** — blocked by k3s NAT (origin: {origin-k3s-nat})
* [ ] **Vocera EAP-TLS Supplicant Fix** (origin: {origin-vocera})
* [ ] **iPSK Manager HA** — blocked by DB replication (Ben Castillo)
* [ ] **ISE 3.4 Migration** — depends on Patch 10 completion first
* [ ] **Git history scrub** — murus-portae-output.md + ise-analytics CSVs
* [ ] **Encrypt `prep-cmds-2026-04-15.adoc`** — plaintext committed to git
* [ ] **ISE MnT Messaging Service** — enable UDP syslog delivery (maintenance window needed)

=== Infrastructure (Personal)

* [ ] Borg backups — test and validate on ALL systems (Razer, P16g, vault-01, bind-01, kvm-01, kvm-02)
* [ ] Borg — verify backup script paths updated from dotfiles-optimus to dots-quantum
* [ ] Borg — create initial archive for ThinkPad P16g if none exists
* [ ] Libvirt VLAN hook debug on both KVMs
* [ ] Te1/0/2 cable replacement and re-test
* [ ] Vault Raft cluster — verify vault-01 rejoined
* [ ] Fix EAP-TLS keyring/secrets issue on Razer workstation

=== Completed (confirmed — do not delete, archive only)

// Move items here with completion date when YOU verify they're done.
// Format: * [x] **Item** — completed YYYY-MM-DD

* [x] **CR-2026-04-15 SRT Research VLAN** — submitted to iTrack. Completed 2026-04-15.
* [x] **CAB presentation 4/21** — SRT Research VLAN 233 → CHLA-Research. APPROVED. Completed 2026-04-21.
* [x] **Downtime Computers wireless audit** — 45 computers, 16 violating, v3 report delivered. Completed 2026-04-21.
* [x] **Git identity fix** — dots-quantum/git/.gitconfig email corrected. Completed 2026-04-21.
* [x] **MSCHAPv2 10:30 meeting** — next steps + ACL coordination. Completed 2026-04-17.

// Worklog Work: ITSM Tickets
// Usage: Included by worklog/work-chla.adoc assembler
// Contains: Active service requests, incidents, and change requests

=== Active Tickets

// Service Requests — SR ticket tracking
// Usage: include::partial$trackers/work/itsm-tickets/service-requests.adoc[]
// Last updated: 2026-04-30

=== Service Requests (SR)

[cols="1,2,2,1,1"]
|===
| SR# | Request | Requestor | Opened | Status

| 3508542
| Zoll cards connection issue
| —
| —
| STALE — verify in iTrack

| 3508524
| Disable dot1x on (2) network ports - 5th floor 3250 Wilshire (PXE-boot imaging issues)
| —
| —
| STALE — verify in iTrack (issues persisted after disable)

| 3528165
| Tube System Upgrade — 15 stations, MAC addresses for ISE IoT_Onboard identity group
| Genest, John (vendor contact)
| 2026-06-01
| NEW — MACs received, need ISE onboarding

|===

// Incidents — INC ticket tracking
// Usage: include::partial$trackers/work/itsm-tickets/incidents.adoc[]
// Last updated: 2026-04-30

=== Incidents (INC)

[cols="1,1,2,1,1,1"]
|===
| INC# | Priority | Description | Opened | SLA | Status

| 1911859
| —
| Strongline Gateways in Miscellaneous Subnet
| —
| —
| STALE — verify in iTrack (related to carryover P0)

|===

// Emergency Changes — ECAB change request tracking
// Usage: include::partial$trackers/work/itsm-tickets/changes-emergency.adoc[]
// Last updated: 2026-04-30

=== Change Requests - Emergency (ECAB)

[cols="1,2,1,1,1"]
|===
| CR# | Description | Opened | Scheduled | Status

| _No emergency changes_
|
|
|
|

|===

// Normal Changes — Standard change request tracking
// Usage: include::partial$trackers/work/itsm-tickets/changes-normal.adoc[]
// Last updated: 2026-04-30

=== Change Requests - Normal

[cols="1,2,1,1,1"]
|===
| CR# | Description | Opened | Scheduled | Status

| _No normal changes_
|
|
|
|

|===

// Scheduled Changes — Scheduled/standard change request tracking
// Usage: include::partial$trackers/work/itsm-tickets/changes-scheduled.adoc[]
// Last updated: 2026-04-30

=== Change Requests - Scheduled/Standard

[cols="1,2,1,1,1"]
|===
| CR# | Description | Opened | Window | Status

| _No scheduled changes_
|
|
|
|

|===

// RCA Changes — Root cause / post-incident change request tracking
// Usage: include::partial$trackers/work/itsm-tickets/changes-rca.adoc[]
// Last updated: 2026-04-30

=== Change Requests - Root Cause / Post-Incident

[cols="1,2,1,1,1"]
|===
| CR# | Description | Related INC | Opened | Status

| 100451
| Vocera Phones and Wyse devices went off network
| —
| —
| STALE — verify in iTrack

|===

---

== Session Accomplishments (Claude Code)

_Day-specific accomplishments here._

---

// Worklog Section: Personal
// Usage: include::partial$worklog/personal.adoc[]
// Contains: Personal projects, adhoc items, reference links

== Personal

// In Progress Projects
// Usage: include::partial$trackers/personal/projects/active.adoc[]
// Last updated: 2026-04-04

=== In Progress

[cols="2,3,1,2"]
|===
| Project | Description | Status | Notes

| k3s Platform
| Production k3s cluster on kvm-01
| Active
| Prometheus, Grafana, Wazuh deployed

| Wazuh Archives
| Enable archives indexing in Filebeat
| Active
| PVC fix pending

| kvm-02 Hardware
| Supermicro B deployment
| Active
| Hardware ready, RAM upgrade done
|===

// Planned Projects
// Usage: include::partial$trackers/personal/projects/planned.adoc[]
// Last updated: 2026-04-30

=== Planned

[cols="2,3,1,2"]
|===
| Project | Description | Target | Blocked By

| Vault HA (3-node)
| vault-02, vault-03 on kvm-02
| Q2 2026 (slipped from Q1)
| kvm-02 deployment

| k3s HA (3-node)
| Control plane HA
| Q2 2026 (slipped from Q1)
| kvm-02 deployment

| ArgoCD GitOps
| k3s GitOps deployment
| After k3s stable
| --

| MinIO S3
| Object storage for k3s
| After ArgoCD
| --

| xref:projects/personal/domus-inventory/index.adoc[Domus Inventory]
| Personal asset management (YAML + CLI + AsciiDoc)
| Q2 2026
| Schema approved
|===

// Active — Infrastructure
// Usage: include::partial$trackers/personal/tasks/active-infrastructure.adoc[]
// Last updated: 2026-06-18

=== Active — Infrastructure

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **Wazuh agent deployment**
| Deploy agents to all infrastructure hosts
| P2
| Pending
| After archives fix

| **k3s Platform**
| Production k3s cluster on kvm-01
| P1
| In Progress
| --

| **Wazuh Archives**
| Enable archives indexing in Filebeat, PVC fix
| P1
| In Progress
| --

| **kvm-02 Hardware**
| Supermicro B deployment, RAM upgrade done
| P1
| In Progress
| --

|===

'''

// Active — Security & Encryption
// Usage: include::partial$trackers/personal/tasks/active-security.adoc[]
// Last updated: 2026-04-04

=== Active — Security & Encryption

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **Configure 4th YubiKey**
| SSH FIDO2 keys
| P1
| TODO
| --

| **Cold storage M-DISC backup**
| age-encrypted archives
| P1
| TODO
| After YubiKey setup

|===

'''

// Active — Development & Tools
// Usage: include::partial$trackers/personal/tasks/active-development.adoc[]
// Last updated: 2026-04-04

=== Active — Development & Tools

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **netapi Commercialization**
| Go CLI rewrite with Cobra-style argument discovery, package for distribution
| P0
| Active
| --

| **Ollama API Service**
| FastAPI (17 endpoints), productize — config audit, doc tools, runbook gen
| P0
| Active
| --

| **Shell functions (fe, fec, fef)**
| File hunting helpers
| P3
| TODO
| --

|===

'''

// Active — Documentation
// Usage: include::partial$trackers/personal/tasks/active-docs.adoc[]
// Last updated: 2026-04-04

=== Active — Documentation

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **D2 Catppuccin Mocha styling**
| domus-* spoke repos (177 files total)
| P3
| In Progress
| --

|===

'''

// Active — Financial
// Usage: include::partial$trackers/personal/tasks/active-financial.adoc[]
// Last updated: 2026-04-04

=== Active — Financial

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **Amazon order history import**
| Download CSV from Privacy Central → parse with awk → populate subscriptions tracker
| P1
| Waiting
| Pending Amazon data export (requested 2026-04-04)

|===

'''

// Active — Education
// Usage: include::partial$trackers/personal/tasks/active-education.adoc[]
// Last updated: 2026-04-04

=== Active — Education

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| _No active education tasks — see education trackers_
|
|
|
|

|===

'''

// Active — Personal & Life Admin
// Usage: include::partial$trackers/personal/tasks/active-personal.adoc[]
// Last updated: 2026-04-04

=== Active — Personal & Life Admin

[cols="2,3,1,1,1"]
|===
| Task | Details | Priority | Status | Due

| **ThinkPad T16g Setup**
| Arch install, stow dotfiles, Ollama stack, netapi dev env
| P0
| Pending
| --

| **P50 Arch to Ubuntu migration**
| xref:case-studies/changes/p50-arch-to-ubuntu/index.adoc[CR-2026-03-12]
| P2
| In Progress
| --

| **X1 Carbon Ubuntu installs**
| 2 laptops, LUKS encryption
| P2
| In Progress
| --

| **P50 Steam Test**
| Test Flatpak Steam + apt cleanup of broken i386 packages
| P3
| Pending
| --

|===

// Documentation Sites Quick Links
// Usage: include::partial$trackers/personal/links/sites.adoc[]
// Last updated: 2026-04-04

==== Documentation Sites

* https://docs.domusdigitalis.dev/[docs.domusdigitalis.dev] - Private documentation hub
* https://docs.architectus.dev/[docs.architectus.dev] - Public portfolio site

=== Notes

_Day-specific personal notes here._

---

// Worklog Section: Education — Assembler
// Usage: include::partial$worklog/education.adoc[]
// Contains: All education domains via sub-partials
//
// PARADIGM: Each domain = its own file in education/
// FILES: ai-engineering.adoc, languages.adoc, study-today.adoc, regex.adoc
//
// MAINTENANCE: Add/remove domains by editing includes below
// To add RHCSA: include::partial$worklog/education/rhcsa.adoc[]

== Education

// Worklog Education: AI Engineering
// Usage: Included by worklog/education.adoc assembler
// Contains: Claude Code + AI training status

=== Claude Code + AI Engineering (ACTIVE)

=== Claude Code Mastery

[cols="2,3,1,1"]
|===
| Resource | Details | Progress | Status

| **Claude Code Full Course (4 hrs)**
| Nick Saraev - YouTube comprehensive course
| 26:49 / 4:00:00
| **IN PROGRESS**

| **Claude Code Certification**
| Anthropic official certification (newly released)
| Not started
| GOAL

|===

=== Active Tracks (Focus)

* xref:education/systems/regex-mastery.adoc[Regex Mastery] | xref:education/systems/regex/index.adoc[Curriculum]
* xref:education/rhcsa/index.adoc[RHCSA 9]
* xref:education/literature/don-quijote.adoc[Don Quijote] - Primera Parte
* xref:education/languages/dele-spanish.adoc[DELE C1/C2]

=== Skills Mastery (Critical)

* xref:education/systems/regex/index.adoc[Regex Mastery] - 10-module curriculum
* xref:education/programming/python.adoc[Python Mastery]
* xref:education/programming/bash.adoc[Bash Mastery]
* https://docs.asciidoctor.org/asciidoc/latest/[AsciiDoc Docs^] - Documentation format
* https://antora.org/[Antora Docs^] - Documentation pipeline

=== Certification Deadlines

* **CISSP** - July 12, 2026 (10-week plan active — Week 1)
* **RHCSA 9** - Q3 2026 (after CISSP)
* **LPIC-1** - Renewal required (blocks LPIC-2)

// Worklog Education: Languages
// Usage: Included by worklog/education.adoc assembler
// Contains: DELE/SIELE certs, Don Quijote writing method

=== Language Certifications (DELE/SIELE)

=== Spanish C1 Certification Goals

[cols="2,2,1,1,2"]
|===
| Certification | Provider | Target | Status | Strategy

| xref:education/languages/siele.adoc[**SIELE C1**]
| https://siele.org/[Instituto Cervantes^] / UNAM / Salamanca
| **Q2 2026**
| ACTIVE
| Computer-based, faster results - take FIRST

| xref:education/languages/dele-spanish.adoc[**DELE C1**]
| https://examenes.cervantes.es/es/dele/que-es[Instituto Cervantes^]
| **Q3/Q4 2026**
| PLANNED
| After SIELE success, harder exam

| xref:education/languages/dele-spanish.adoc[**DELE C2**]
| https://examenes.cervantes.es/es/dele/que-es[Instituto Cervantes^]
| 2027
| FUTURE
| Mastery level - requires extensive immersion

|===

TIP: SIELE is computer-adaptive, results in 3 weeks. DELE is paper-based, results in 3-4 months. Do SIELE first to validate readiness.

=== Don Quijote Writing Practice - DELE C1/C2 Initiative

**Method:**

1. Read chapter in original Spanish
2. Write personal analysis/understanding _en espanol_
3. AI review for grammar, vocabulary, register
4. Build comprehensive understanding of literary elements

// Worklog Education: Today's Study
// Usage: Included by worklog/education.adoc assembler
// Contains: Current study focus pointer

=== Today's Study

* **Focus:** CISSP (41 days to July 12 exam — schedule exam today 06-01), MSCHAPv2 migration wrap-up
* **Secondary:** RHCSA curriculum, Spanish SIELE C1
* [ ] CISSP — Security & Risk Management (continuing). **Schedule exam this afternoon.**
* [ ] RHCSA — continue curriculum phase
* [ ] Spanish — Don Quijote reading + analysis (DTLA study day)
* [ ] MSCHAPv2 — migration window closed 05-30, review final report

// Worklog Education: Regex Training
// Usage: Included by worklog/education.adoc assembler
// Contains: Regex training status (remove when complete)

=== Regex Training (CRITICAL)

* **Status:** 52 days carried over (since 2026-03-16)
* **Priority:** After PeopleSoft, before Quijote
* **Session:** Character classes, word boundaries

---

// Worklog Section: Infrastructure
// Usage: include::partial$worklog/infrastructure.adoc[]
// Contains: Infrastructure sites, HA status, SPOFs, validation

== Infrastructure

// Documentation Sites
// Usage: include::partial$trackers/personal/infrastructure/sites.adoc[]
// Last updated: 2026-04-04

=== Documentation Sites

[cols="2,2,1,2"]
|===
| Site | URL | Status | Actions Needed

| **Domus Digitalis**
| https://docs.domusdigitalis.dev[docs.domusdigitalis.dev]
| Active
| Validate, harden, improve

| **Architectus**
| https://docs.architectus.dev[docs.architectus.dev]
| Active
| Public portfolio site - maintain

|===

// HA Deployment Status
// Usage: include::partial$trackers/personal/infrastructure/ha-status.adoc[]
// Last updated: 2026-04-04

=== HA Deployment Status

[cols="2,2,1,2"]
|===
| System | Description | Status | Notes

| **VyOS HA**
| vyos-01 (kvm-01) + vyos-02 (kvm-02) with VRRP VIP
| ✅ COMPLETE
| 2026-03-07 - pfSense decommissioned

| **BIND DNS HA**
| bind-01 (kvm-01) + bind-02 (kvm-02) with AXFR
| ✅ COMPLETE
| Zone transfer operational

| **Vault HA**
| Raft cluster (vault-01/02/03)
| ✅ COMPLETE
| Integrated with PKI

| **Keycloak Rebuild**
| keycloak-01 corrupted, rebuild from scratch
| 🔄 NEXT
| Priority P3 - SSO broken

| **FreeIPA HA**
| ipa-02 replica planned
| 📋 PLANNED
| Linux auth redundancy

| **AD DC HA**
| home-dc02 replication
| 📋 PLANNED
| Windows auth redundancy

| **iPSK Manager HA**
| ipsk-mgr-02 with MySQL replication
| 📋 PLANNED
| PSK portal redundancy

| **ISE HA**
| PAN HA (ise-01 reconfigure)
| ⏳ DEFERRED
| Wait until ise-02 stable

| **ISE 3.5 Migration**
| Upgrade path: 3.2p9 → 3.4 (P1) → 3.5 (target)
| 📋 PLANNED
| After 3.4 Migration completes (Q2 2026)

|===

// Single Points of Failure
// Usage: include::partial$trackers/personal/infrastructure/spof.adoc[]
// Last updated: 2026-04-04

=== Single Points of Failure (CRITICAL)

WARNING: These systems have NO redundancy - outage impacts production.

[cols="2,2,3"]
|===
| System | Impact if Down | Mitigation

| **ISE (ise-02)**
| All 802.1X stops - wired and wireless auth fails
| ise-01 reconfiguration deferred until ise-02 stable

| **Keycloak (keycloak-01)**
| SAML/OIDC SSO broken (ISE admin, Grafana, etc.)
| **NEXT PRIORITY** - Rebuild runbook

| **FreeIPA (ipa-01)**
| Linux auth, sudo rules, HBAC fails
| ipa-02 replica planned

| **AD DC (home-dc01)**
| Windows auth, Kerberos, GPO fails
| home-dc02 replica planned

| **iPSK Manager**
| Self-service PSK portal unavailable
| ipsk-mgr-02 with MySQL replication planned

|===

// Validation Tasks
// Usage: include::partial$trackers/personal/infrastructure/validation.adoc[]
// Last updated: 2026-04-04

=== Validation Tasks

[cols="2,3,1"]
|===
| Task | Details | Status

| docs.domusdigitalis.dev validation
| Test all cross-references, search, rendering
| TODO

| docs.domusdigitalis.dev hardening
| HTTPS, CSP headers, security review
| TODO

| docs.architectus.dev validation
| Public site content review
| TODO

| Hub-spoke sync verification
| All components building correctly
| Ongoing

|===

---

// Worklog Section: Quick Commands — Assembler
// Usage: include::partial$worklog/quick-commands.adoc[]
// Sub-partials: commands/<category>.adoc
//
// PARADIGM: Each tool domain = its own file in commands/
// Add new categories by adding an include below.
// Graduate mature entries to codex/ pages.
//
// MAINTENANCE: Add new commands to the appropriate sub-partial.
// Split when a sub-partial exceeds ~150 lines.

== Quick Commands

// Commands: Git & GitHub CLI
// Graduated from: .drafts/domus-terminal-workflows-2026-04-23.adoc
// Promote mature entries to: codex/git/

=== Git & GitHub CLI

.create GitHub repo from existing local repo
[source,bash]

.clone a forked repo into a specific directory
[source,bash]

NOTE: `gh repo clone` defaults to SSH. If key is passphrase-protected, load agent first: `eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519_github`

.cross-repo commit search — all domus repos on a specific date
[source,bash]

.commit history touching only today's modified files
[source,bash]

.unstage a file without losing changes
[source,bash]

Safe — removes from staging area only. Working tree is untouched. Use when you accidentally `git add` a plaintext or output file.

==== gh CLI — repo discovery and filtering

.list repos by name pattern (domus/antora ecosystem)
[source,bash]

.top 20 most recently updated repos
[source,bash]

.top 10 repos by disk usage
[source,bash]

.clone a repo that's not local yet
[source,bash]

// Commands: find & grep
// Graduated from: .drafts/domus-terminal-workflows-2026-04-23.adoc, find-discovery-2026-04-18.adoc
// Promote mature entries to: codex/cli/find.adoc, codex/cli/grep.adoc

=== find & grep

.files modified since midnight today (precise — not "last 24 hours")
[source,bash]

NOTE: `-mtime 0` means "last 24 hours", not "today". `-newermt "$(date +%F)"` compares against midnight — exact.

.case-insensitive file search
[source,bash]

.multiple name patterns with -o
[source,bash]

.same thing, single regex — fewer parens, extensible
[source,bash]

.exclude directories
[source,bash]

.recent drafts by modification time (newest first)
[source,bash]

.grep — know what you're counting
[source,bash]

.search with context — avoid opening the file
[source,bash]

==== Search codex by content — which files contain a command?

.find all PowerShell files that use a specific cmdlet
[source,bash]

Pattern: `find -exec grep -l` returns only filenames with matches — like `grep -rl` but with `find`'s `-type f -name` filtering. Use `\|` for OR in `grep` basic regex. Swap the pattern for any cmdlet or keyword to locate coverage across the codex.

.inventory a codex tool directory — count files per tier
[source,bash]

.find orphaned examples (not included by any page)
[source,bash]

==== find → grep → open in nvim

.find by path + content, open result in nvim
[source,bash]

Command substitution `$(...)` feeds all matches as arguments to nvim — opens every hit as a buffer. `:bn`/`:bp` to cycle, `:ls` to list. One file? Opens directly. Five files? All loaded, ready to navigate.

.find by content across entire tree, open in nvim
[source,bash]

.open one at a time (sequential — -exec nvim per match)
[source,bash]

WARNING: Trailing `\|` in grep patterns matches empty string — every file matches. Always end with a term, not a pipe: `'timeout\|expire\|token'` not `'timeout\|expire\|token\|'`.

==== Trace Antora partial inclusion chains

.who includes this partial? (one level up)
[source,bash]

.count all pages that include a partial
[source,bash]

.full chain: partial → assembler → every page that uses it
[source,bash]

Pattern: `grep -rl` finds which files contain the string. Chain two passes — first finds the assembler partial, second finds every page that includes it. Works for any partial in the Antora include hierarchy.

==== Multi-pattern file search — worklog partial discovery

.brute force — one find per partial name
[source,bash]

.consolidated — single find with regex (production approach)
[source,bash]

Pattern: `-regextype posix-extended` enables `|` alternation without escaping. One process, one sort — versus 8 separate finds. The `sort` deduplicates visually and groups by path.

.pipeline alternative — find piped to grep
[source,bash]

Trade-off: the pipeline version is more readable but spawns two processes. The regex version is a single `find` — faster on large trees, same result.

==== Cross-repo literary term search — bibliotheca-wide discovery

When searching for a term across the entire `_bibliotheca` (multiple repos, mixed file types), these patterns escalate from narrow to broad.

.1. Single repo — count matches per file
[source,bash]

.2. Cross-repo — filenames only (all bibliotheca)
[source,bash]

.3. Cross-repo with context — see the line in situ
[source,bash]

.4. Multi-filetype — .adoc + .txt (catches source texts)
[source,bash]

.5. Null-safe find + xargs — handles spaces in paths
[source,bash]

.6. Open all hits directly in nvim
[source,bash]

Pattern escalation: #1 confirms the term exists and where. #2 expands to all repos. #3 shows context without opening files. #4 adds plain text sources (Quijote `.txt` originals). #5 is the safe version for automation. #6 opens everything for editing.

Trade-off: `grep -r --include` is faster for known file types. `find | xargs grep` is safer for paths with spaces and more extensible (add `-name '*.md'` etc.). For literary searches across the bibliotheca, #4 or #5 is usually the right starting point — the source texts are `.txt`, not `.adoc`.

==== Search daily notes — find commands, builds, and patterns across worklogs

_Source: 2026-06-22 — searching for `build-antora-page` invocations and theme usage across partials_

.which daily note partials mention a command?
[source,bash]

.see the match in context without opening the file
[source,bash]

.search for any theme flag across all partials (PCRE alternation)
[source,bash]

.find + grep — search all daily note partials for build/export patterns
[source,bash]

.find + awk — show filename:matching_line for every hit (no -r needed)
[source,bash]

.awk state machine — extract full [source,bash] blocks containing a command
[source,bash]

The awk state machine: `[source,bash]` sets `block=1` and starts buffering. Each line appends to `buf`. When the closing `----` arrives (and `block>1` to skip the opening fence), check if the buffer contains the target command. If yes, print filename + entire block. Reset. One pass, arbitrary block size, no temp files.

.sed address range — print only lines between code fences matching a pattern
[source,bash]

.search data/ too — standalone adoc outside Antora
[source,bash]

.every invocation sorted by path (chronological by date directory)
[source,bash]

Pattern escalation: `grep -rl` → "where is it". `grep -rn -C3` → "what's around it". `find -exec awk` → "extract the structured block". `sed` address ranges → "print between delimiters". Each tool has a different affordance — `grep` finds, `awk` extracts structure, `sed` filters ranges, `find -exec` scales across trees.

==== Email thread analysis — extract people, dates, commitments, silence

.who's in the thread (@ mentions + From headers)
[source,bash]

.timeline — every date with context
[source,bash]

.commitments — who promised what
[source,bash]

.open questions and unknowns
[source,bash]

==== comm — set difference (who hasn't replied)

[source,bash]

`comm -23` outputs lines only in file 1 (recipients not in senders). Requires sorted input. `grep -oP '<\K[^>]+'` uses PCRE lookbehind — match `<` but don't include it, capture until `>`.

==== Sort find results by modification time (newest first)

`find` discovers files but has no sort. Chain `-printf` with `sort` to order by mtime.

WARNING: `awk '{print $2}'` truncates filenames with spaces — `Familia Romana_ Lingva...` becomes `Familia`. Always use the null-safe or `sub()` variants below for real data.

.epoch sort — space-safe (production version)
[source,bash]

`sub(/^[^ ]+ /,"")` removes everything up to and including the first space (the epoch). `{print $2}` would split on _every_ space — fatal for `Familia Romana_ Lingva Latina`.

.human-readable timestamps alongside
[source,bash]

`%T+` renders `YYYY-MM-DD+HH:MM:SS` — no epoch math needed, still sorts correctly as text.

.null-safe — the bulletproof version
[source,bash]

`-printf '%T@\t%p\0'` — tab separates epoch from path, null terminates. `sort -z` sorts null-delimited records. `awk -v RS='\0' -F'\t'` reads null-terminated, splits on tab — `$2` is now the full path regardless of spaces.

.stat fallback — portable (BSD/macOS)
[source,bash]

`-exec ... {} +` batches all files into one `stat` call (faster than `\;`). On macOS, use `stat -f '%m %N'` instead of `--format='%Y %n'`.

==== File intelligence — size, type, duplicates, age

Beyond finding files — interrogating them.

.top 10 largest files in a directory tree
[source,bash]

`numfmt --to=iec --field=1` converts the first field from bytes to K/M/G. `sort -rn` on raw bytes is exact — `ls -lhS` rounds and sometimes mis-sorts.

.find duplicates by size (fast pre-filter before checksumming)
[source,bash]

.find duplicates by content — definitive
[source,bash]

Two-pass: first find duplicate sizes (cheap), then md5sum only those (expensive). `uniq -w32 -D` compares first 32 chars (the hash) and prints all duplicates.

.file type census — what's actually in this directory?
[source,bash]

`file --mime-type -b` reports actual content type. `-b` suppresses filename. A `.pdf` that's really `text/html` is a failed download.

.stale files — untouched for 30+ days
[source,bash]

`-atime +30` = access time older than 30 days. `-printf '%A+'` shows last access. Useful for Downloads cleanup without deleting something you just renamed.

.disk usage by subdirectory — sorted
[source,bash]

==== Batch operations — rename, move, transform

.rename all files — strip spaces, lowercase, normalize unicode
[source,bash]

`IFS= read -r -d ''` — the holy trinity for null-safe filename reading. `IFS=` prevents whitespace trimming. `-r` prevents backslash interpretation. `-d ''` reads until null.

.move files by extension into categorized subdirectories
[source,bash]

`${f##*.}` — parameter expansion: strip longest match of `*.` from front, leaving only the extension. No `basename` or `awk` needed.

.batch convert epub → asciidoc (like your Cicero fetch script)
[source,bash]

`-exec sh -c '...' _ {} +` — batch mode. `_` fills `$0` (script name, discarded). All matched files become `$1, $2, ...` iterated by `for epub`. One `sh` invocation, not one per file.

==== xargs power patterns

.parallel processing — 4 cores
[source,bash]

`-P4` runs 4 `md5sum` processes simultaneously. `-print0 | xargs -0` is the null-safe pipeline — no filename can break it.

.batched execution — two arguments at a time
[source,bash]

`-n2` feeds two arguments per invocation. Useful for pairwise comparisons, copy operations (`-n2` with `cp`), or any command taking exactly two args.

.placeholder — insert filename at specific position
[source,bash]

`-I{}` replaces `{}` with each filename. Slower than `+` batching (one `cp` per file) but necessary when the filename must appear in a specific position.

==== Process substitution — diff without temp files

.compare two directory listings
[source,bash]

`<(cmd)` creates a file descriptor from command output. `diff` sees two "files" — no temp files created, no cleanup needed.

.compare file counts across directories
[source,bash]

// Commands: awk, sed, jq — Text Processing
// Graduated from: .drafts/terminal-mastery-session-2026-04-19.adoc,
//   .drafts/domus-terminal-workflows-2026-04-22.adoc
// Promote mature entries to: codex/awk/, codex/jq/

=== awk, sed, jq

==== awk — field extraction

.print second field (whitespace-delimited)
[source,bash]

.custom delimiter — colon-separated (like /etc/passwd)
[source,bash]

.extract JSON code blocks from AsciiDoc
[source,bash]

.field extraction with printf formatting
[source,bash]

==== sed — stream editing

.in-place replacement with verify-before/after
[source,bash]

.extract line range
[source,bash]

==== sed — line-targeted replacement (verify-before / change / verify-after)

.the full pattern: locate → validate → change → verify
[source,bash]

Without the line number prefix (`1760s/`), `sed` replaces every match in the file — a shotgun. With it, surgical. The line number comes from `grep -n`.

.multi-line verify — check two specific lines at once
[source,bash]

.range extraction — NR for surgical reads from large files
[source,bash]

No `head | tail` chains. No `sed -n '44160,44210p'`. One `awk`, two numbers.

==== grep -oP with \K — value extraction from key-value logs

.extract just the value after a key (Perl regex)
[source,bash]

`\K` resets the match start — everything before `\K` is required context but excluded from output. `[^,;]+` captures until the next delimiter. Pipe to `sort -u` for unique, `sort | uniq -c | sort -rn` for counted frequency.

.pattern: grep -oP 'KEY=\KVALUE_REGEX' | sort pipeline
[source,bash]

==== jq — JSON processing

.extract nested fields
[source,bash]

.filter array by property
[source,bash]

.transform to TSV for spreadsheets
[source,bash]

.GitHub API + jq — commit history by path
[source,bash]

// Commands: Shell Patterns (bash/zsh)
// Graduated from: .drafts/domus-terminal-workflows-2026-04-23.adoc
// Promote mature entries to: codex/bash/

=== Shell Patterns

==== xargs — when the next command reads arguments, not stdin

[cols="1,2"]
|===
| Next command reads... | Use

| stdin (`awk`, `grep`, `wc`, `sort`) | pipe directly
| arguments (`stat`, `rm`, `cp`, `nvim`, `git add`) | `xargs`
|===

.copy today's files to backup — `-I{}` placeholder
[source,bash]

.parallel validation — `-P4` runs 4 at a time
[source,bash]

.null-delimited pipeline — safe for filenames with spaces
[source,bash]

==== Process substitution — `<(cmd)` treats output as a file

.compare tracker state: yesterday vs today
[source,bash]

.files on disk vs files in nav — drift detection
[source,bash]

==== Command substitution — embed output as arguments

.open most recently modified file in nvim
[source,bash]

.line count across a project
[source,bash]

==== Conditional execution — capture, test, act

.open matching files only if they exist
[source,bash]

.open files that contain unchecked items
[source,bash]

.guard with grep -q — only act if pattern matches
[source,bash]

Pattern: `$(capture)` → `[ -n ]` tests non-empty → `&&` only proceeds if true.
`grep -q` is the idempotent guard — run repeatedly, only opens when there's work.

==== Decrypt and open — find .age, decrypt, nvim in one shot

[source,bash]

Pattern: find `.age` only (never tries plaintext), `sed` derives the decrypted path, guard prevents empty nvim. Change the glob to match any project.

==== tee_clean — color on screen, clean text in file

[source,bash]

The `>(cmd)` is process substitution — `tee` writes to stdout AND to the subshell pipe. `sed` strips ANSI escape sequences (`\x1b\[[0-9;]*m`) before they hit the file.

==== Dependency check — verify toolchain in one shot

[source,bash]

Pattern: `command -v` checks if binary exists on PATH. `>/dev/null 2>&1` suppresses output — we only care about exit code. Swap the tool list for any project's dependencies.

==== printf safety — dashes as data, not options

.wrong — printf treats `---` as invalid option
[source,bash]

.right — %s format string treats `---` as data
[source,bash]

==== Kill stuck SSH sessions

.Find established SSH connections
[source,bash]

.Kill all stuck SSH sessions to a specific host
[source,bash]

.Kill ALL stuck SSH sessions
[source,bash]

`lsof -i TCP -n -P` lists all TCP connections. `awk` filters for SSH + ESTABLISHED, prints only the PID (`$2`). `sort -u` deduplicates (multiple file descriptors per process). `xargs kill` sends SIGTERM to each.

// Commands: File Descriptors & Redirection
// Graduated from: .drafts/terminal-mastery-session-2026-04-19.adoc
// Promote mature entries to: codex/bash/

=== File Descriptors & Redirection

==== The three file descriptors

[cols="1,1,3"]
|===
| FD | Name | Purpose

| 0 | stdin | input to the command
| 1 | stdout | normal output (valid results)
| 2 | stderr | error messages
|===

==== Split stdout and stderr into separate files

[source,bash]

==== Suppress errors — `2>/dev/null`

[source,bash]

==== Merge stderr into stdout — `2>&1`

[source,bash]

This sends both stdout and stderr through the pipe. Without `2>&1`, only stdout reaches grep — errors print to the terminal and bypass the pipeline.

==== Heredoc patterns

.multi-line input to a command
[source,bash]

.heredoc commit messages (quotes prevent variable expansion)
[source,bash]

// Commands: API & curl/jq
// Graduated from: quick-commands.adoc (existing)
// Promote mature entries to: codex/fastapi/, codex/jq/

=== API & curl/jq

==== domus-api — Documentation System REST API

.start the API server
[source,bash]

.health check
[source,bash]

.full-text search
[source,bash]

.search — extract path, title, match count
[source,bash]

.list pages by category
[source,bash]

.all antora.yml attributes
[source,bash]

==== GitHub API

.cross-repo search via GitHub API
[source,bash]

.count .adoc files in a repo via API
[source,bash]

// Commands: Domus Documentation System — Terminal Workflows
// Graduated from: .drafts/domus-terminal-workflows-2026-04-21.adoc
// Promote mature entries to: codex/documentation/

=== Domus Workflows

==== Read content from terminal (meeting-ready)

.today's worklog
[source,bash]

.current priorities
[source,bash]

.carryover backlog
[source,bash]

.any project summary
[source,bash]

==== Search and discovery

.find all files related to a topic
[source,bash]

.search codex entries
[source,bash]

.list all worklogs for a month
[source,bash]

==== Tracker aging — calculate days from origin

.how many days since a carryover item started
[source,bash]

==== Encrypted data access (d001)

.view encrypted file without disk write
[source,bash]

.project encryption dashboard
[source,bash]

==== d000 study builds

.batch build all docs for a Quijote chapter range
[source,bash]

.build a single study doc (use unique path fragment)
[source,bash]

.batch build PDFs for a chapter range
[source,bash]

.open all rendered chapters at once
[source,bash]

.print chapter PDFs (requires CUPS configured)
[source,bash]

.build LPL logic study (English / Spanish)
[source,bash]

.build Cicero study
[source,bash]

==== Available themes

.PDF themes (--theme)
[source,bash]

.HTML variants (--variant)
[source,bash]

// Commands: ISE & Network Operations
// Graduated from: .drafts/terminal-mastery-session-2026-04-19.adoc,
//   data/d000/infra/ references
// Promote mature entries to: codex/networking/, codex/security/

=== ISE & Network Ops

==== ISE ERS API — endpoint CRUD

.set credentials (session)
[source,bash]

.list identity groups
[source,bash]

.check if endpoint exists by MAC
[source,bash]

==== Certificate inspection

.view EAP-TLS client cert from local store
[source,bash]

.check cert expiry
[source,bash]

==== Network diagnostics

.check listening ports
[source,bash]

.test ISE connectivity
[source,bash]

.DNS resolution
[source,bash]

==== ISE eval rotation — backup & restore

.backup from ISE CLI (when admin UI is license-locked)
[source,bash]

.list backups on NAS
[source,bash]

.restore to fresh ISE node
[source,text]

==== VyOS — VRRP & VLAN inspection

.VRRP status and VIPs
[source,bash]

.firewall zone membership
[source,bash]

.DHCP leases and ARP
[source,bash]

.full interface/VLAN map
[source,bash]

==== CUPS printing — validation & setup

.software validation
[source,bash]

.daemon lifecycle
[source,bash]

.printer discovery
[source,bash]

.add printer and set default
[source,bash]

.print
[source,bash]

// Commands: PowerShell (from zsh)
// Graduated from: .drafts/domus-terminal-workflows-2026-04-23.adoc
// Promote mature entries to: codex/powershell/

=== PowerShell (from zsh)

NOTE: All PowerShell commands run inside `pwsh -NoLogo -Command '...'` from zsh. Running them bare fails — zsh interprets `$`, `|`, `()` as shell syntax.

==== Process management

.top 5 processes by memory
[source,bash]

.stop/start Teams
[source,bash]

==== Export to JSON (pipe to jq)

.always use -NoLogo when piping pwsh output to zsh tools
[source,bash]

WARNING: Never pipe `Format-Table` into `ConvertTo-Json` — it produces layout metadata, not data. `Select-Object` first, then `ConvertTo-Json`.

==== Wi-Fi management (netsh)

.force fresh network scan
[source,powershell]

==== SSH from PowerShell

.connect to homelab from Windows terminal
[source,powershell]

==== WSL ↔ Windows — Cross-Environment Commands

===== From zsh (WSL) — control Windows

.run any PowerShell command from zsh
[source,bash]

.run multi-line PowerShell from zsh (heredoc)
[source,bash]

.open a file in Windows from WSL
[source,bash]

.copy WSL output to Windows clipboard
[source,bash]

.access Windows files from WSL
[source,bash]

===== From PowerShell — control WSL

.run a bash command from PowerShell
[source,powershell]

.run a specific WSL command and capture output
[source,powershell]

===== Process Management — Windows Side

.top processes by memory — formatted table
[source,bash]

.find a specific process
[source,bash]

.kill by name
[source,bash]

.kill by PID
[source,bash]

.what's listening on a port (Windows equivalent of ss -tulnp)
[source,bash]

.specific port check
[source,bash]

===== Services — Windows Side

.list running services
[source,bash]

.check a specific service
[source,bash]

.restart a service
[source,powershell]

===== System Info — Quick Health from zsh

.one-shot Windows system summary
[source,bash]

.disk usage — all drives
[source,bash]

===== Exchange Online — Connect from zsh

.connect to Exchange Online (launches MFA prompt in Windows)
[source,bash]

NOTE: MFA prompt opens in the Windows browser. After auth, the session persists in the `pwsh` process. For multi-command sessions, start `pwsh` interactively instead of one-shot commands.

.interactive PowerShell session from zsh (for Exchange, etc.)
[source,bash]

===== File Transfer Patterns

.move files between WSL and Windows
[source,bash]

.watch Windows Downloads for new files (live)
[source,bash]

NOTE: `inotifywait` requires `inotify-tools`. Install with `sudo pacman -S inotify-tools` if not present.

// Commands: Security & Encryption
// Graduated from: .drafts/domus-terminal-workflows-2026-04-23.adoc
// Promote mature entries to: codex/security/

=== Security & Encryption

==== View encrypted files without writing to disk

.pipe age decrypt to bat — nothing touches the filesystem
[source,bash]

==== Batch re-encrypt — brace expansion + loop

.re-encrypt multiple project files
[source,bash]

WARNING: Always `rm -f` the `.age` first. If you skip it, `encrypt-file` prompts about overwrite and may only delete the plaintext without re-encrypting.

==== Detect stale plaintext — files needing re-encryption

.find plaintext newer than its .age counterpart
[source,bash]

==== Secure delete — shred for sensitive plaintext

[source,bash]

NOTE: On SSD/NVMe, `shred` is less effective (wear leveling), but better than `rm` which only removes the directory entry.

==== Pre-push audit — find all unencrypted project files

[source,bash]

// Commands: System & Infrastructure
// Graduated from: quick-commands.adoc (existing), .drafts/
// Promote mature entries to: codex/

=== System & Infrastructure

==== PipeWire audio validation

[source,bash]

==== gopass — personal document management

[source,bash]

==== Makefile — daily workflow

[source,bash]

==== KVM — VM & ISO management

.list VMs on a KVM host
[source,bash]

.find ISE ISOs across KVM hosts (case-insensitive glob)
[source,bash]

.console into a VM
[source,bash]

.check NAS mount on KVM host
[source,bash]

==== Per-project file dashboard

.per-project summary — total files vs unencrypted plaintext
[source,bash]

==== USB-C / Thunderbolt Charging Diagnostics

.Full evidence capture to file (one block, timestamped)
[source,bash]

Pattern: `{ }` groups commands into a single stdout stream. `tee` writes to file AND displays on screen. Reusable for any multi-command evidence capture — change the commands inside, keep the structure.

==== pacman — package inspection

_Source: 2026-06-25 — curl error 77 investigation, checking for package upgrades_

[source,bash]

---

// Worklog Section: Related Documents
// Usage: include::partial$worklog/related.adoc[]
// Contains: Common cross-references for worklogs

== Related Documents

* xref:education/literature/quijote/index.adoc[Don Quijote - Estudio Completo]
* xref:projects/chla/PRJ-peoplesoft-time-entry.adoc[PeopleSoft Time Entry]
* xref:trackers/quarterly-q2-2026.adoc[Q2 2026 Tracker]
* xref:patterns/index.adoc[Pattern Journal]