infrastructure

Administer the canonical Forgejo server - converge branch protection and repo PR/merge settings across owned repos, plus docker/git credential auth through the attended admin-token helper. Use when protecting a branch after creating a repo, auditing drift, converging merge policy, or fixing Forgejo docker/git credential failures. Aliases - forgejo branch protection, forgejo repo settings, forgejo docker auth, forgejo git credentials, forgejo-creds.

Mint and provision the fleet's git-forge credentials without static PATs - short-lived GitHub App tokens for warded github.com runs, plus Forgejo bot / CI / Flux / tap / scoop PATs in SSM. Aliases - mint token, github app token, forgejo pat, ci release token, tap bump token, scoop write token.

Operate the safe Forgejo <-> GitHub mirror reconcile - auto-merges GitHub's merged-PR commits into canonical Forgejo and republishes both sides. Covers when to run it, the per-repo reconcile model, dry-run vs live dispatch, conflict handling, and the staged cutover. Aliases - mirror sync, mirror reconcile, forgejo github mirror, reconcile mirrors, github mirror, forgejo mirror, mirror drift, mirror-reconcile.

Install, self-heal, or clean up the Claude Code remote-control daemon behind the claude.ai/code Remote Control dropdown on kai-server, kai-desktop-tower (WSL + Windows), and the Macs. Use when a host is missing from the dropdown, shows duplicate rows, drops out overnight with exec claude not found / status 127, or when standing up a new host. Aliases - remote control dropdown, kai-server daemon, node-tooling-ensure, node orphan, status 127 claude not found, claude.service cleanup.

Set up and operate the coilysiren Eco game server on kai-server - download/install, push mods, start via systemd, Discord Link + Chronicler, NidToolBox, and game-state resets. Flags the legacy-vs-kai-server path split so old invoke commands do not bite. Aliases - eco server setup, set up eco server, eco game server, push eco mods, restart eco server, eco resets, nidtoolbox, chronicler, discord link.

Use when working on, arming, debugging, or reasoning about the @claude / /claude impl containerized implementer that lands on main from a Forgejo issue comment - the gate script, the claude-issue.yml workflow, the INERT-by-design enablement + author gates, the goose+qwen (not Anthropic-key) backing, per-issue cap and concurrency, or why a summon did or did not fire. Aliases - @claude, /claude impl, claude dispatch, claude-issue.yml, claude_dispatch.py gate, CLAUDE_DISPATCH_ENABLED.

Operate the @coilyco-ops summon bot - a Forgejo poller that turns `@coilyco-ops <request>` on an issue or PR into a Goose advisory reply. Use when summoning Goose for an advisory pass, gating who may drive the bot, dry-running the poll, installing its timer, or explaining how it differs from claude-dispatch. Default-deny and advisory only, never pushes main. Aliases - coilyco-ops, @coilyco-ops, summon Goose, ops summon, advisory bot, coilyco_ops_summon.

Diagnose tailnet host health and reachability for the infra fleet - grab a post-incident host-diag snapshot, auto-capture one on each dead->alive SSH recovery via host-watch, probe node-global pressure (conntrack/load/apiserver), and read fleet reachability across the k3s pair and towers. Use when a host flaps, an SSH hop goes dark, or a reachability row goes red. Aliases - host diagnostics, host-diag, host-watch, fleet reachability, node pressure, tailnet host down, SSH flap, conntrack.

Diagnose silent pod evictions on the kai-server k3s cluster. Walks events, describe output, node taints, OOM kills, ephemeral-storage pressure, image-pull failures, and QoS-class evictions in a top-down order. Aliases - k3s eviction, pod eviction, pod evicted, why was my pod evicted, kubelet eviction, k3s pod eviction, k3s-pod-eviction-diagnosis, evicted pod debug, pod disappeared, pod restart loop.

Instructions for updating the k3s homelab cluster one machine at a time while preserving custom systemd ExecStart arguments.

k3s cluster, systemd units, and invoke tasks that run kai-server - the host behind my personal apps and sites. Triggers - infrastructure, homelab-iac, invoke-tasks, k3s-cluster, kai-server, systemd-units