pastilhasandClaude Opus 5
8662f94b3b
deadpool-rezio-bridge joins the list: 100.64.0.21, checkout /home/br/officerdev/platform, deployed by
hand and verified — 7/7 processes online, username NOT NULL, uq_users_username_lower present, HEAD at
bd41dff5.
Its login is `br` and always will be. That makes the SSH user a per-host fact rather than a constant,
so the table carries it and the deploy prompt reads it. Worth stating plainly because the failure is
misleading: an orchestrator assuming `pastilhas` gets "Permission denied (publickey)", which reads as a
broken key rather than a wrong username.
Also folded in what tonight established. Three hosts answer to names that disagree with
`tailscale status` — edge-bridge and gitea-bridge are the old ones — so the table says which to use.
`edge-bridge` was listed as "not SSH-reachable" and that was wrong: its SSH was down at the moment I
checked, not absent. The pm2/nvm PATH trap is written in, including that `-lc` is not enough and cost
two wrong conclusions, and that macbookpro must not be helped with an exported PATH because doing so
breaks pm2. And a dirty tree means TRACKED changes; plain --porcelain skipped a host over a stray file.
officer.rezio.dev is recorded under "known wrong, waiting on someone else": it points at gateway rather
than deadpool, which is worse than unavailable — it will serve the wrong box the moment gateway answers
on 443.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
5.8 KiB
Servers — the running list
Every machine the owner runs, how to reach it, and what of Officer is on it. Kept here so an orchestrator ("pull and update every platform", "restart officer everywhere", "which host is behind") has one place to read rather than a fact re-derived per session.
Verified 2026-08-21 from officer-dev by SSH and pm2 jlist, except where marked assumed.
How access works
All of it is over the tailnet, key-based, no ~/.ssh/config, no passwords, no jump hosts, no ports.
The login user is NOT always pastilhas. It is per host and it is in the table below. deadpool runs
as br and always will — the owner's key is authorised for that account. An orchestrator that hard-codes
a username fails on that host and will fail on the next one like it.
ssh alpha # pastilhas, implied
ssh br@deadpool-rezio-bridge # not implied
Officer platforms
Seven, all running.
| Host | Tailnet IP | Login | Checkout | Domain |
|---|---|---|---|---|
officer-dev |
100.64.0.13 | pastilhas |
~/officer-dev/platform |
platform.officer.dev |
alpha |
100.64.0.1 | pastilhas |
~/officerdev/platform |
officer.pastilhas.dev |
fofos |
100.64.0.17 | pastilhas |
~/officerdev/platform |
officer.fofosfluffybastards.com |
macbookpro |
100.64.0.9 | pastilhas |
~/projects/officer-suite/platform |
macbookpro.pastilhas.dev |
edge-pertento-bridge |
100.64.0.15 | pastilhas |
~/officerdev/platform |
edge.pertento.ai |
production-pertento-bridge |
100.64.0.12 | pastilhas |
~/officerdev/platform |
officer.pertento.ai |
deadpool-rezio-bridge |
100.64.0.21 | br |
/home/br/officerdev/platform |
officer.rezio.dev [pending] |
Only platform.officer.dev is public (77.42.39.155). The rest resolve to tailnet addresses and are
reachable from inside only.
Names that disagree with themselves
Three hosts answer to more than one name, and tailscale status is not always the one in use:
In tailscale status |
Also | The machine's own hostname |
|---|---|---|
edge-bridge |
edge-pertento-bridge |
edge-pertento |
gitea-bridge |
production-pertento-bridge |
PPROD |
deadpool-rezio-bridge |
— | deadpool |
The middle column is what to use. edge-bridge and gitea-bridge are the old names and are being
retired; anything reading tailscale status will still see them.
Things that will catch out an orchestrator
All verified, none cosmetic.
- The checkout path differs per host — four distinct shapes across seven machines. Take it from PM2:
the
officerprocess'spm_cwd.alphacarries a SECOND, stale checkout at~/dockers/officer.dev/platform, and pulling that one succeeds while changing nothing. pm2is not on a non-interactive PATH. It lives under nvm, and nvm's setup is in.zshrc, which a login shell does not read. Usessh <host> '$SHELL -ic "pm2 jlist"'.-lcis not enough — it reports "command not found" on machines where pm2 is plainly running, which cost two wrong conclusions on 2026-08-21.- On
macbookpro, do not help the PATH. Exporting one to reachbunbreakspm2, which is only on the interactive shell's.$SHELL -icand nothing else. - The git remotes differ.
fofospulls over HTTPS; the others over SSH. Never assume a URL — pull in place. - A "dirty tree" means TRACKED changes.
git status --porcelaincounts untracked files, and a stray script a fast-forward could never touch is not a reason to skip a host. Use--untracked-files=no. macbookprois a laptop. It may be asleep. Unreachable is a skip with a note, not a failed deploy.
Not platforms — ignore for now
A checkout may be present; no officer process runs on any of these. Whether they are retired, staging
or half-installed is not established — ask before treating them as targets.
| Host | Tailnet IP |
|---|---|
headscale |
100.64.0.2 |
omega |
100.64.0.3 |
gateway |
100.64.0.4 |
Other machines on the tailnet
- Not SSH-reachable (port 22 refused):
edge-dns(100.64.0.8),officer-bridge(100.64.0.5). Assumed service-only containers — not confirmed.edge-bridgewas listed here until 2026-08-21 and was wrong: its SSH was simply down at the time of checking. - Client devices, not servers:
iphone16,andres-ipad,pixel9a, plus other people's devices in the tailnet (diogos-ipad,iphone-diogo,iphone-bruno,fedras-iphone,guilhermes-macbook-pro,macbook-pro-de-joo).
Known wrong, waiting on someone else
officer.rezio.devresolves to 100.64.0.4 — that isgateway, notdeadpool(100.64.0.21). Not merely unavailable: pointed at a different machine, so it will serve the wrong box the moment gateway answers on 443. Ports 80 and 443 are closed ondeadpool, so nothing fronts it yet. Waiting on the domain owner.
Keeping this list true
It rots when a server is added, a checkout moves, a platform is retired, a remote changes or a login differs. Re-verify with the four commands it was built from:
tailscale status
ssh <login>@<host> '$SHELL -ic "pm2 jlist"' # the officer entry's pm_cwd
ssh <login>@<host> 'git -C <cwd> remote get-url origin'
getent hosts <domain>