Erich Blume 7983677da2 Fix wiki-links to use filename-based resolution

Quartz's "shortest" path mode resolves wiki-links by filename, not
frontmatter title. This fixes the broken links from the previous
title-based approach.

Changes:
- Rename zk duplicate files with -log suffix to avoid conflicts
- Rename reference/storage/postgresql.md to postgresql-storage.md
- Convert all wiki-links from [[Title]] to [[filename|Title]] format
- Rename doc-card-titles task to doc-filenames (checks filename uniqueness)
- Update pre-commit hook for renamed task

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-03 15:27:23 -08:00

1.8 KiB

Raw Blame History

title

Tailscale

Tailnet tail8d86e.ts.net provides secure networking for all BlumeOps infrastructure.

ACL Management

ACLs managed via Pulumi in pulumi/policy.hujson.

Groups

Group	Members	Purpose
`group:allisonflix`	admin, member	[[jellyfin

Device Tags

Tag	Devices	Purpose
`tag:homelab`	indri	Server infrastructure
`tag:nas`	sifaka	Network-attached storage
`tag:blumeops`	indri, sifaka	Pulumi IaC managed resources
`tag:registry`	indri	Container registry access
`tag:k8s-api`	indri	Kubernetes API server access

Important: Don't tag user-owned devices (like gilbert). Tagging converts them to "tagged devices" which lose user identity and break user-based SSH rules.

Access Matrix

Source	Kiwix	Forge	PyPI	Miniflux	PostgreSQL	NAS	Grafana	Loki
`autogroup:admin`	Y	Y	Y	Y	Y	Y	Y	Y
`autogroup:member`	Y	Y	Y	Y	Y	-	-	-
`tag:homelab`	-	-	-	-	-	Y	-	-

Admins - full access to all services
Members - member services only, no Grafana/Loki/NAS

SSH Access

Source	Destinations	Auth
`autogroup:member`	`autogroup:self`	check
`autogroup:admin`	`tag:homelab`	check (12h)
`autogroup:admin`	`tag:nas`	check (12h)

OAuth Credentials

Pulumi uses OAuth client from 1Password (blumeops vault):

Scopes: acl, dns, devices, services
Auto-applies tag:blumeops to IaC-managed resources

routing - Service URLs
hosts - Device inventory

1.8 KiB Raw Blame History